CVE-2015-2378

Vulnerability

CVE-2015-2378 is an untrusted search path vulnerability in Microsoft Excel. It affects Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3. The vulnerability occurs when Excel loads a DLL from the current working directory without proper validation, allowing an attacker to place a malicious DLL in that directory [1].

Exploitation

An attacker must have local access to the system and be able to write a malicious DLL to the current working directory. The victim then opens an Excel file from that directory, causing Excel to load the attacker's DLL instead of the legitimate one. No authentication beyond the local user session is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user. If the user has administrative privileges, the attacker can gain full control of the system, leading to complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Microsoft released security update MS15-070 on July 14, 2015, which addresses this vulnerability by correcting how Excel handles DLL loading. Users should apply the update via Windows Update or direct download. No workarounds are documented in the available references [1].