CVE-2015-1642 | Microsoft Office - Document Parsing Component Operational Intel

Executive Risk Summary

"A memory corruption vulnerability exists in Microsoft Office that allows remote attackers to execute arbitrary code via a crafted document. This vulnerability affects Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1, and can be exploited by an attacker to gain control of the affected system."

Anticipated Attack Path

1. Phishing or social engineering to deliver the crafted document
2. Exploitation of the memory corruption vulnerability
3. Execution of arbitrary code on the victim's system

Am I Vulnerable?

Verify that Microsoft Office is updated to the latest patch level
Implement email and document scanning to detect and block malicious documents
Educate users on the risks of opening documents from unknown sources

Operational Audit Arsenal

Target Type Process

Target Asset winword.exe

Standard Path C:\Program Files\Microsoft Office\Root\Office16

PowerShell

# 🛠️ Senior Engineer Universal Audit
# Target: winword.exe (Process)
$Targets = 'winword.exe'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")

Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue | 
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}