#VU1188 Buffer overflow in InPage - CVE-2017-12824

Vulnerability identifier: #VU1188

Vulnerability risk: Critical

CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2017-12824

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
InPage
Client/Desktop applications / Office applications

Vendor: Concept Software Private Limited

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists within text processor when parsing .inp files. A remote attacker can create a specially crafted .inp file, trick the victim to open it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in full system compromise.

Note: this vulnerability is being actively exploited in the wild against financial institutions in Asia. The latest attack report is dated November 3, 2017.

Mitigation
Install update from vendor's website. Reportedly, version 3.6.0 fixes the vulnerability.

Vulnerable software versions

InPage: 2009 - 2016

---

External links
https://securelist.com/blog/research/76717/inpage-zero-day-exploit-used-to-attack-financial-institutions-in-asia/
https://researchcenter.paloaltonetworks.com/2017/11/unit42-recent-inpage-exploits-lead-multiple-malw...

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.