Exploit:Win32/Tudimons.A

The Exploit:Win32/Tudimons.A operates by targeting a specific weakness in Microsoft Office's security model. This means the software incorrectly uses unverified external input when making a security decision. In practical terms, the vulnerability lets a specially crafted Office file bypass the built-in mitigations that normally stop untrusted or known-vulnerable COM/OLE controls from activating. OLE and COM controls are technologies used for embedding interactive content. 

The Common Vulnerability Scoring System (CVSS) 3.1 score for the underlying vulnerability is 7.8. The vector string breaks down as follows: Attack Vector is Local (AV:L), Attack Complexity is Low (AC:L), no Privileges are Required (PR:N), User Interaction is Required (UI:R), the Scope is Unchanged (S:U), and impacts on Confidentiality, Integrity, and Availability are all High (C:H/I:H/A:H). Microsoft further scores the exploitability metrics as Functional for Exploit Code Maturity, Official Fix for Remediation Level, and Confirmed for Report Confidence. 

This attack requires local access, meaning the malicious file must be delivered to and opened on the target device. The threat actor must trick a user into opening the file, as the Preview Pane is not a valid attack route. Successful exploitation bypasses the OLE mitigation security feature, which is designed to protect users from vulnerable controls. The primary mitigation involves setting a "kill bit" in the Windows Registry for the specific COM control with the Class Identifier (CLSID) {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}. This is done by creating a registry value named Compatibility Flags of type REG_DWORD and setting its data to 400in hexadecimal. This registry key must be placed under one of several paths, depending on the Office installation: 

• For 64-bit MSI-installed Office (or 32-bit on 32-bit Windows): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\ 
• For 32-bit MSI-installed Office on 64-bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\ 
• For 64-bit Click-to-Run Office (or 32-bit on 32-bit Windows): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\16.0\Common\COM Compatibility\ 
• For 32-bit Click-to-Run Office on 64-bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\ 

The COM Compatibility subkey needs to be created manually if it does not exist.