CVE-2023-50235
📋 TL;DR
A stack-based buffer overflow vulnerability in Hancom Office Show's PPT file parser allows remote attackers to execute arbitrary code when users open malicious PowerPoint files. This affects all installations of vulnerable Hancom Office Show versions. User interaction is required as victims must open a malicious file.
💻 Affected Systems
- Hancom Office Show
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer, enabling data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Malware installation leading to data exfiltration, credential theft, or system disruption through targeted phishing campaigns with malicious PPT attachments.
If Mitigated
Limited impact with proper email filtering blocking malicious attachments and endpoint protection preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user to open malicious file but no authentication needed. Buffer overflow to RCE is straightforward once file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references; check Hancom security advisory for patched version.
Vendor Advisory: Not provided in references; check Hancom website for security updates.
Restart Required: Yes
Instructions:
1. Check Hancom security advisory for patch details.
2. Download and install latest Hancom Office Show update.
3. Restart system to ensure patch is fully applied.
4. Verify version is updated to patched release.
🔧 Temporary Workarounds
Disable PPT file association
windowsPrevent Hancom Office Show from automatically opening PPT files by changing file associations.
Windows: Control Panel > Default Programs > Set Associations > Change .ppt/.pptx to open with different application
Application control blocking
allUse endpoint protection to block Hancom Office Show execution or restrict to trusted files only.
🧯 If You Can't Patch
- Implement strict email filtering to block PPT attachments from untrusted sources.
- Use application whitelisting to prevent unauthorized execution of Hancom Office Show.
🔍 How to Verify
Check if Vulnerable:
Check Hancom Office Show version against vendor's patched version list. If version is older than patched release, system is vulnerable.Check Version:
Windows: Check Help > About in Hancom Office Show interface. Linux/macOS: Check application info or package manager.Verify Fix Applied:
Verify Hancom Office Show version matches or exceeds patched version specified in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Hancom Office Show (e.g., cmd.exe, powershell.exe spawned)
- Crash logs from Hancom Office Show with memory access violations
Network Indicators:
- Outbound connections from Hancom Office Show to suspicious IPs post-file opening
- DNS requests to malicious domains following PPT file processing
SIEM Query:
Process Creation where ParentImage contains 'Hancom' AND (Image contains 'cmd.exe' OR Image contains 'powershell.exe')