|
@0patch | |||||
|
We issued a micropatch for CVE-2017-11774, a remote code execution vulnerability in Outlook that has been widely exploited and remains popular with attackers. In contrast to official patch which could be reverted by non-admins, micropatch will reliably disable Outlook Home Page. pic.twitter.com/3MW0l0PvuV
|
||||||
|
||||||
|
|
0patch
@0patch
|
28. sij |
|
The micropatch simply overrides Outlook's reading of WebView settings for determining whether Home Page is enabled, and makes Outlook believe the answer is "disabled" regardless of what the Registry says. This prevents the bypass. Source code contains just one instruction: pic.twitter.com/1G4OjnaqhJ
|
||
|
||
|
|
0patch
@0patch
|
28. sij |
|
The micropatch is currently written for the last vulnerable version of Outlook 2016 but it will be trivial to port it to any other affected Outlook version. Anyone interested is welcome to contact us at sales@0patch.com
|
||
|
|
||
|
|
0patch
@0patch
|
28. sij |
|
A good article on recent exploitation of CVE-2017-11774 by Iran-nexus threat actors from @FireEye: fireeye.com/blog/products-…
|
||
|
|
||