Microsoft Word and Office Suite Remote Code Execution Vulnerability (CVE-2006-2492)

# Query Windows Update for the specific legacy KB patch (e.g., KB917334 for MS06-027)
$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$UpdateSearcher = $UpdateSession.CreateUpdateSearcher()
$SearchResult = $UpdateSearcher.Search("KBID='917334' or Description like '*MS06-027*'")

if ($SearchResult.Updates.Count -gt 0) {
    Write-Host 'Missing security patch detected. Initiating installation...' -ForegroundColor Yellow
    # In production, deploy via WSUS, SCCM, or modern MDM solutions.
} else {
    Write-Host 'Security patch is already applied or the system is not vulnerable.' -ForegroundColor Green
}

# Force High Security Level for Word to block unauthorized macro and object execution
New-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\11.0\Word\Security' -Name 'Level' -Value 4 -PropertyType DWord -Force
Write-Host 'Word Security Level has been set to High.' -ForegroundColor Green

# Retrieve the file version of winword.exe from the registry path
$wordPath = (Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe' -ErrorAction SilentlyContinue).'(default)'
if ($wordPath) {
    $fileVersion = (Get-Item $wordPath).VersionInfo.FileVersion
    Write-Host "Detected Word Version: $fileVersion"
    # Check against patched version for Office 2003 (11.0)
    if ($fileVersion -lt '11.0.8117.0') {
        Write-Host '[WARNING] Vulnerable version of Microsoft Word detected. Immediate patching required.' -ForegroundColor Red
    } else {
        Write-Host '[SAFE] Microsoft Word is patched or running a secure version.' -ForegroundColor Green
    }
} else {
    Write-Host 'Microsoft Word is not installed on this system.' -ForegroundColor Cyan
}