Signature Detail

HTTP: Microsoft Word RTF listoverridecount Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft Word. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."

Affected Products

• Microsoft office_compatibility_pack *
• Microsoft office_web_apps 2010
• Microsoft office_word_viewer *
• Microsoft word 2003
• Microsoft word 2007
• Microsoft word 2010

References

• CVE: CVE-2012-2539
• CVE: CVE-2014-1761
• URL: http://blogs.mcafee.com/mcafee-labs/close-look-rtf-zero-day-attack-cve-2014-1761-shows-sophistication-attackers
• URL: https://www.virustotal.com/en/file/e378eef9f4ea1511aa5e368cb0e52a8a68995000b8b1e6207717d9ed09e8555a/analysis/