Microsoft Office OLE2Link vulnerability (CVE-2017-0199)【转】

漏洞详情参考：

来源http://www.kb.cert.org/vuls/id/921560

• Office OLE2Link zero-day（来自NCCGroup）
• CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler （来自FireEye）

HTAsThe Microsoft OLE2Link object contains a vulnerability in the way that it processes remotely-linked content. The remote content is opened based on the application associated with the server-provided MIME type. Some MIME types are dangerous, as they can result in code execution. For example, the application/hta mime type is associated with mshta.exe. Opening arbitrary HTA content is equivalent to executing arbitrary code. This vulnerability is reportedly being exploited in the wild. The exploits used in the wild have the following characteristics:

• The document that triggers the OLE2Link vulnerability is an RTF document that masquerades as a Microsoft Word DOC file.
• The exploit connects to a remote server to obtain an execute an HTA file, which contains VBScript to be executed by the client.

Note that depending on the nature of the vulnerability, it may be possible to target Microsoft Windows components other than Microsoft Word. This vulnerability reportedly affects all versions of Microsoft Office, including Office 2016 on Windows 10. It is also reported that Microsoft Office Protected View can help prevent exploitation without user interaction.

This vulnerability is reportedly being exploited in the wild.