Merge pull request #393 from halos/master

Added detection for Equations Editor (CVE-2017-11882) in 'rtfobj'

Merge pull request #393 from halos/master
Added detection for Equations Editor (CVE-2017-11882) in 'rtfobj'
Philippe Lagadec · GitHub
2 parents f9a63e0c ca08ea6b
Showing 1 changed file with 5 additions and 0 deletions
oletools/rtfobj.py
@@ -904,6 +904,11 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
             if rtfobj.class_name == b'OLE2Link':
                 ole_color = 'red'
                 ole_column += '\nPossibly an exploit for the OLE2Link vulnerability (VU#921560, CVE-2017-0199)'
+            # Detect Equation Editor exploit
+            # https://www.kb.cert.org/vuls/id/421280/
+            elif rtfobj.class_name.lower() == b'equation.3':
+                ole_color = 'red'
+                ole_column += '\nPossibly an exploit for the Equation Editor vulnerability (VU#421280, CVE-2017-11882)'
         else:
             ole_column = 'Not a well-formed OLE object'
         tstream.write_row((