CVE-2018-5195
📋 TL;DR
CVE-2018-5195 is a critical buffer overflow vulnerability in Hancom NEO office software that allows remote attackers to execute arbitrary commands by exploiting hyperlink attributes in documents. Attackers can achieve remote code execution when users open malicious documents. This affects all users of vulnerable Hancom NEO versions.
💻 Affected Systems
- Hancom NEO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the victim's computer, enabling data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Remote code execution leading to malware installation, credential theft, or data exfiltration when users open malicious documents.
If Mitigated
Limited impact with proper application sandboxing, least privilege execution, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires user interaction to open malicious document. Buffer overflow leads to arbitrary code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.6.1.5184 and later
Vendor Advisory: http://help.hancom.com/cve/hoffice/en-US/CVE_en_050_01.htm
Restart Required: Yes
Instructions:
1. Download latest Hancom NEO version from official website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Disable hyperlink processing
windowsPrevent document hyperlinks from being processed automatically
Use application sandboxing
windowsRun Hancom NEO in restricted environment to limit exploit impact
🧯 If You Can't Patch
- Block all Hancom NEO documents at network perimeter and email gateways
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Hancom NEO version in Help > About. If version is 9.6.1.5183 or earlier, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 9.6.1.5184 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Process creation from Hancom NEO with unusual command-line arguments
- Memory access violations in Hancom NEO process logs
Network Indicators:
- Outbound connections from Hancom NEO to suspicious IPs
- Document downloads followed by unusual process execution
SIEM Query:
Process Creation where Parent Process contains 'Hancom' AND Command Line contains unusual patterns