Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.
#OFFICE 365 FOR WINDOWS 10 DOWNLOAD#
Make sure you have the displaying of file extensions enabled to properly create the Registry file.Īlternatively, you can download the registry file from here. Then save the file as disable-activex.reg.
#OFFICE 365 FOR WINDOWS 10 UPDATE#
Workaround for CVE-2021-40444 zero-day attacksĪs there is no security update available at this time, Microsoft has provided the following workaround - disable the installation of all ActiveX controls in Internet Explorer.Ī Windows registry update ensures that ActiveX is rendered inactive for all sites, while already available ActiveX controls will keep functioning. He reported the vulnerability to Microsoft early Sunday morning. The researcher told us that the attack method is 100% reliable, which makes it very dangerous. Executing the threat is done using "a trick called 'Cpl File Execution'," referenced in Microsoft's advisory. Malware is then downloaded by using a specific ActiveX control in the web page. Upon opening it, the document loaded the Internet Explorer engine to render a remote web page from the threat actor. In a reply to BleepingComputer, Haifei Li of EXPMON said that the attackers used a. In a tweet today, EXPMON (exploit monitor) says that they found the vulnerability after detecting a “highly sophisticated zero-day attack” aimed at Microsoft Office users.ĮXPMON researchers reproduced the attack on the latest Office 2019 / Office 365 on Windows 10. Researchers from multiple cybersecurity companies are credited for finding and reporting the vulnerability: Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang - all three of Mandiant, and Rick Cole of Microsoft Security Intelligence. Microsoft's enterprise security platform will display alerts about this attack as "Suspicious Cpl File Execution." Systems with active Microsoft’s Defender Antivirus and Defender for Endpoint (build 1.349.22.0 and above) benefit from protection against attempts to exploit CVE-2021-40444. Protected View is a read-only mode that has most of the editing functions disabled, while Application Guard isolates untrusted documents, denying them access to corporate resources, the intranet, or other files on the system. However, the attack is thwarted if Microsoft Office runs with the default configuration, where documents from the web are opened in Protected View mode or Application Guard for Office 365. The attacker would then have to convince the user to open the malicious document” - Microsoft “An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine.
0 kommentar(er)
