CVE-2019-16337
📋 TL;DR
This vulnerability in Hancom Office's hncbd90 component allows attackers to trigger a use-after-free memory corruption by opening a specially crafted .docx file. This could potentially lead to arbitrary code execution with the privileges of the user opening the document. All users of Hancom Office 9.6.1.9403 who open untrusted documents are affected.
💻 Affected Systems
- Hancom Office
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment when a user opens a malicious document.
Likely Case
Application crash or denial of service, with potential for limited code execution depending on exploit sophistication.
If Mitigated
No impact if documents are only opened from trusted sources or if the vulnerability is patched.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious document. Use-after-free vulnerabilities can be challenging to exploit reliably.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version via Hancom update mechanism
Vendor Advisory: http://help.hancom.com/update_en_multilang/details/HOfficeNEO_update.htm
Restart Required: Yes
Instructions:
1. Open Hancom Office. 2. Go to Help menu. 3. Select Check for Updates. 4. Follow prompts to download and install latest version. 5. Restart Hancom Office applications.
🔧 Temporary Workarounds
Disable automatic document opening
allConfigure Hancom Office to not automatically open documents from untrusted sources
Use alternative office software
allTemporarily use Microsoft Office or LibreOffice for opening untrusted .docx files
🧯 If You Can't Patch
- Implement application whitelisting to block execution of Hancom Office
- Use email filtering to block .docx attachments from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Hancom Office version in Help > About. If version is exactly 9.6.1.9403, system is vulnerable.Check Version:
On Windows: Check Help > About in Hancom Office GUI. No direct command-line version check available.Verify Fix Applied:
After updating, verify version is no longer 9.6.1.9403 and matches latest version from vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes of Hancom Office with memory access violations
- Unexpected process termination of hwp.exe or related processes
Network Indicators:
- Unusual network connections originating from Hancom Office processes after document opening
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="hwp.exe" AND ExceptionCode="0xc0000005"