Events

Patch Tuesday July 2012 – Focus on the Browser

This month’s patch Tuesday brings a set of three “critical” bulletins focused on Windows/web browser component vulnerabilities and six other bulletins rated “important”. In other words, two of the critical components are considered “Windows” components, but most likely would be attacked through the web browser. Also, the top priority bulletin patches the CVE-2012-1889 vulnerability being exploited not only by attackers targeting high value targets, but common-off-the-shelf/commodity exploit packs.

Kaspersky products detect malicious web pages exploiting CVE-2012-1889 with “HEUR:Exploit.Script.Generic”. Addition of a working exploit targeting MSXML Core Services 3.0 within IE6 and IE7 XPSP3 to the Metasploit Framework on June 12th helped make this one more mainstream. While it may seem that targeting XP would limit its reach, it’s important to note that various market share surveys and reports show that Windows XP continues to take major OS market share. Interestingly, the MS12-043 Bulletin addressing this vulnerability patches MSXML Core Services 3, 4, and 6, leaving out version 5. Versions 3 and 6 ship with Windows itself. Accordingly, msxml3.dll and msxml6.dll reside in c:windowssystem32 across all supported versions of Windows, while the other versions are installed by Microsoft Office and other software.

Also patching the potential for web client-side drive-by’s, MS12-045 addresses an MDAC vulnerability, reminiscent of MS06-014, one of the longest lasting, reliable, most heavily targeted client-side vulnerabilities in Microsoft technology. It was taken advantage of for years by the Russian Business Network, purchasers of MPack, and later others, distributing Torpig and Rustock, while the nascent exploit kit market was solidifying back in 2006. It continues to be included in some of the live exploit pack control panels that we see. We’ll see how this new MDAC issue compares.

The third of the bulletins fighting “critical” rated web client side vulnerabilities fixes a couple of newer vulnerability types being targeted (“Cached Object Remote Code Execution Vulnerability – CVE-2012-1522”, “Attribute Remove Remote Code Execution Vulnerability – CVE-2012-1524”) introduced by Internet Explorer version 9 itself. Versions 6, 7 and 8 do not maintain the vulnerable code.

With that, we leave you to your regularly scheduled patching.


Follow me on Twitter

Patch Tuesday July 2012 – Focus on the Browser

Your email address will not be published.

 

Reports

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Lazarus Trojanized DeFi app for delivering malware

We recently discovered a Trojanized DeFi application that was compiled in November 2021. This application contains a legitimate program called DeFi Wallet that saves and manages a cryptocurrency wallet, but also implants a full-featured backdoor.

MoonBounce: the dark side of UEFI firmware

At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41.

Subscribe to our weekly e-mails

The hottest research right in your inbox