Zero-day vulnerabilities discovered: 434
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.
Note, this vulnerability is being actively exploited in the wild.
This vulnerability was reported by Anton Ivanov and Alexey Kulaev of Kaspersky Lab. This vulnerability was used in Operation WizardOpium campaign against Korean users.
Software: Windows
This vulnerability was reported by Anton Ivanov and Alexey Kulaev of Kaspersky Lab. This vulnerability was used in Operation WizardOpium campaign against Korean users.
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Software: Microsoft Internet Explorer
Links:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429
Use-after-free
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing HTML content within the audio component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.
Note, this vulnerability is being actively exploited in the wild.
Kaspersky Lab has identified in the wild exploitation of the vulnerability. This vulnerability was used in Operation WizardOpium campaign against Korean users.
Software: Google Chrome
Kaspersky Lab has identified in the wild exploitation of the vulnerability. This vulnerability was used in Operation WizardOpium campaign against Korean users.
Links:
Use-after-free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a use-after-free error within the scripting engine in JScript.dll. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Software: Microsoft Internet Explorer
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the ws2ifsl.sys (Winsock). A local user can run a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.
Note, this vulnerability is being actively exploited in the wild.
Software: Windows
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Windows Common Log File System (CLFS) driver. A local user can create a specially crafted application and execute arbitrary code on the system with elevated privileges.
Note, this vulnerability is being actively exploited in the wild.
Software: Windows
NULL pointer dereference
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a NULL pointer dereference error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.
Note, this vulnerability is being actively exploited in the wild.
Software: Windows
Known/fameous malware:
Win32/Exploit.CVE-2019-1132.A
VBA/TrojanDropper.Agent.ABM
VBA/TrojanDropper.Agent.AGK
Win32/Spy.Buhtrap.W
Win32/Spy.Buhtrap.AK
Win32/RiskWare.Meterpreter.G
Links:
Permissions, Privileges, and Access Controls
The vulnerability allows a local to escalate privileges on the system.
The vulnerability exists due to the way splwow64.exe handles certain calls. A local user can abuse this functionality to elevate privileges on an affected system from low-integrity to medium-integrity.
Note, this vulnerability is being actively exploited in the wild.
Software: Windows
Permissions, Privileges, and Access Controls
The vulnerability allows a remote attacker to bypass sandbox restrictions.
The vulnerability exists due to insufficient vetting of parameters passed with the Prompt:Open
IPC message between child and parent processes. A remote attacker can create a specially crafted web page that can make the non-sandboxed parent process open web content chosen by a compromised child process.
An attacker can combine this behavior along with another vulnerability to execute arbitrary code on the system with privileges on the current user.
Note, this vulnerability is being exploited in the wild along with SB2019061805 (CVE-2019-11707)
This vulnerability was used along with CVE-2019-11707 in a targeted attack against Conbase.
Software: Mozilla Firefox
This vulnerability was used along with CVE-2019-11707 in a targeted attack against Conbase.
Deserialization of Untrusted Data
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data within XMLDecoder class. A remote non-authenticated attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Oracle has released a security alert, notifying users on in the wild exploitation of the vulnerability.
Software: Oracle WebLogic Server
Type Confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error when manipulating JavaScript objects due to issues in Array.pop
. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild along with SB2019062002 (CVE-2019-11708).
The vulnerability was reported by Mozilla to be actively exploited in the wild.
This vulnerability as reportedly used in a targeted attack against Coinbase employees on Monday, June 17 2019.
The vulnerability was used in conjunction with another sandbox bypass issue CVE-2019-11708, patched by Mozilla on June 20, 2019.
This vulnerability was independently discovered and reported to Mozilla by a security researcher Samuel Gro├Я on April 15. It took Mozilla 64 days to issue a security fix.
Software: Mozilla Firefox
The vulnerability was reported by Mozilla to be actively exploited in the wild.
This vulnerability as reportedly used in a targeted attack against Coinbase employees on Monday, June 17 2019.
The vulnerability was used in conjunction with another sandbox bypass issue CVE-2019-11708, patched by Mozilla on June 20, 2019.
This vulnerability was independently discovered and reported to Mozilla by a security researcher Samuel Gro├Я on April 15. It took Mozilla 64 days to issue a security fix.
Links:
Input validation error
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the way Windows Error Reporting (WER) handles files. A local user can create a specially crafted WER file and execute arbitrary code on the system in kernel mode.
Note: this vulnerability is being actively exploited in the wild.
Software: Windows
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the WhatsApp VOIP stack when processing SRTCP packets. A remote attacker can send a series of specially crafted SRTCP packets sent to a target phone number, trigger buffer overflow and execute arbitrary code on the target device.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability was used in a targeted attack against a limited number of people. First vulnerability exploitation was detected on May 12 2019. The attackers targeted a phone of a UK-based human rights lawyer to install spyware.
Software: WhatsApp Messenger for Android
Known/fameous malware:
Pegasus
Links:
Improper access control
The vulnerability allows a remote attacker to gain unauthorized access to the website.
The vulnerability exists due to improper access restrictions when processing HTTP requests. A remote attacker can pass specially crafted configuration to the affected application and inject arbitrary JavaScript code WordPress configuration.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable application.
Note: the vulnerability is being actively exploited i the wild.
Improper access control vulnerability in the plugin allowed attacker to inject malicious JavaScript code and redirect users to phishing websites.
Software: Related Posts
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability was reported to Microsoft by Vasily Berdnikov and Boris Larin from Kaspersky Lab.
Software: Windows
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing objects in memory within the Microsoft Graphics Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability was reported to Microsoft by Donghai Zhu of Alibaba Cloud Intelligence Security Team.
Software: Windows
Hidden functionality (backdoor)
The vulnerability allows a remote attacker to compromise vulnerable system
The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote attacker can use this functionality to gain full access to the application and compromise the affected system.
Note: this backdoor was implented as a result of ASUS servers compromise within the APT attack dubbed тАЬOperation ShadowHammerтАЭ. The campaign ran from June to at least November 2018.
Software: ASUS Live Update
Cross-site scripting
The vulnerability allows a remote attacker to perform cross-site scripting attacks.
The vulnerability exists due to usage of the eval() JavaScript call on data passed via the "swp_url" HTTP GET parameter to "/wp-admin/admin-post.php" script, when "swp_debug" is set to "load_options", allowing to permanently inject and execute arbitrary JavaScript code on the website. A remote unauthenticated attacker can store a specially crafted JavaScript code into database and execute it in browser of every website visitor.
Note: this vulnerability is being actively exploited in the wild.
Exploitation example:
http://[host]/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://[malicious_js_script]/
A stored XSS vulnerability in the Social Warfare plugin, used by 70 000 users, led to a mass hacking campaign of WordPress websites.
Software: WordPress Social Sharing Plugin – Social Warfare
Links:
Deserialization of Untrusted Data
The vulnerability allows a remote attacker to compromise vulnerable website.
The vulnerability exists due to insecure input validation when processing serialized data passed via the "swpsmtp_import_settings" HTTP POST parameter to /easy-wp-smtp.php script. A remote unauthenticated attacker can import arbitrary wp_options and reconfigure WordPress to allow user registration with administrative privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable website.
Note: this vulnerability is being actively exploited in the wild.
WordPress websites were under attack due to vulnerability in a popular WP plugin since March 15, 2019.
Software: Easy WP SMTP
Memory corruption
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Win32k.sys driver. A local user can execute a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Kaspersky Lab has detected and reported a zero-day vulnerability in Win32k.sys driver in Microsoft Windows.
Software: Windows
NULL pointer dereference
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a NULL pointer dereference error in the win32k!MNGetpItemFromIndex when NtUserMNDragOver() system call within the win32k.sys kernel driver. A local user can use a specially crafted application to escape sandbox and execute arbitrary code on the target system with SYSTEM privileges.
Note, this vulnerability is being actively exploited in the wild along with vulnerability in Google Chrome described in (SB2019030405).
On March 7th Google has reported in the wild exploitation of vulnerability in Microsoft Windows. During the attack the adversary used another zero-day vulnerability in Google Chrome in order to execute code on the system and vulnerability in Microsoft Windows to escalate privileges.
The initial attack was detected in late February.
Software: Windows
Links:
Use-after-free
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in FileReader. A remote attacker can trick the victim into opening a specially crafted file with Google Chrome, trigger use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability is being exploited in the wild.
The vulnerability in Google Chrome was used in a targeted attack along with another zero-day in Microsoft Windows.
The initial attack was detected in late February.
Software: Google Chrome
The vulnerability in Google Chrome was used in a targeted attack along with another zero-day in Microsoft Windows.
The initial attack was detected in late February.
Dangerous file upload
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when processing file uploads. A remote attacker can upload and execute arbitrary code on the target system with privileges of the ColdFusion service. Successful exploitation of the vulnerability requires that the attacker has the ability to upload files.
Note, this vulnerability is being actively exploited in the wild.
Software: ColdFusion
Exposed dangerous method or function
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the PDF viewer allows sending information to a third-party domain via the "this.submitForm()" PDF Javascript API. A remote attacker can trick the victim into opening a specially crafted PDF file with Google Chrome and obtain sensitive information.
Note: the vulnerability is being actively exploited in the wild.
Vulnerability exploitation was spotted by EdgeSpot in late December 2018. The company detected multiple PDF samples in the wild that use dangerous JavaScript method to send information, retrieved from user's computer to a third-party domain.
Software: Google Chrome
Out-of-bounds read
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to boundary error when processing HTML content. A remote attacker can trick the victim to open a specially crafted webpage, trigger out-of-bounds read and test for the presence of files on disk.
Software: Microsoft Internet Explorer
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges.According to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.
Software: Apple iOS
Memory corruption
The vulnerability allows a local attacker to gain elevated privileges.According to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.
Software: Apple iOS
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing web pages. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Software: Microsoft Internet Explorer
Race condition
The vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to a race condition within the Kernel Transaction Manager driver (ntoskrnl.exe) when processing transacted file operations in kernel mode. A local user can create a specially program, and run arbitrary code on the system n kernel mode.
Note: the vulnerability is being exploited in the wild.
This vulnerability was reported to Microsoft by Kaspersky Lab. It is believed it was used by FruityArmor and SandCat APT groups against companies in the Middle East and Africa.
Software: Windows
Links:
Use-after-free
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing SWF files. A remote attacker can create a specially crafted .swf file, trick the victim to open it and execute arbitrary code on system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability is being exploited in the wild.
Vulnerability exploitation was spotted by several security companies. The attack was detected on November 29, 2018 and seems to be executed by a Ukrainian APT group UA-APT.
360 Core Security dubbed the attack "Operation Poison Needles".
Software: Adobe Flash Player
Vulnerability exploitation was spotted by several security companies. The attack was detected on November 29, 2018 and seems to be executed by a Ukrainian APT group UA-APT.
360 Core Security dubbed the attack "Operation Poison Needles".
Links:
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within Win32k.sys driver. A local user can create a specially crafted application, run it on vulnerable system and execute code withe superuser privileges.
Note: this vulnerability is being actively exploited in limited targeted attacks.
The vulnerability was privately reported to Microsoft by Kaspersky Lab.
Software: Windows
Segmentation fault
The vulnerability allows a remote attacker to cause DoS condition on the target system.According to MITRE statement, the vulnerability has been exploited in the wild in November 2018.
Software: Suricata
Input validation error
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.
Note, this vulnerability is being actively exploited in the wild against a limited number of targets.
The vulnerability was discovered during the resolution of a Cisco TAC support case and reported by Cisco PSIRT.
Software: Cisco ASA 5500-X Series
Logic error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to a logical bug is revealed when embedding a video via the 'online video' feature. A remote attacker can embed a video inside a Word document, edit the XML file named document.xml, replace the video link with a crafted payload created by the attacker which opens Internet Explorer Download Manager with the embedded code execution file and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Note: as of October 31, 2018 the vulnerability is being actively exploited in the wild.
Trend Micro has issued a report detailing in the wild exploitation of a publicly disclosed vulnerability in Microsoft Word. According to VirusTotal timestamps, the first wave of exploitation began on October 31, 2018. The vulnerability was disclosed on October 25.
Software: Microsoft Word
Known/fameous malware:
TROJ_EXPLOIT.AOOCAI
TSPY_URSNIF.OIBEAO
Links:
Arbitrary file upload
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability exists in the plugin's source code that handles file uploads to PHP servers due to software allows upload of arbitrary files to the system. A remote unauthenticated attacker can upload arbitrary .htaccess file to impose security restrictions to its upload folder and upload backdoors and web shells.
The vulnerability is publicly known since at least 2015.
Software: jQuery File Upload
Links:
Privilege escalation
The vulnerability allows a remote attacker to gain elevated privileges on the target system.
The weakness exists due to the software fail to do capability checks when executing its internal action save_setting
to make such configuration changes when processing arbitrary options and values to this endpoint. A remote attacker can set the users_can_register
option to 1, and change the default_role
of new users to тАЬadministratorтАЭ to simply fill out the form at /wp-login.php?action=register
and immediately access a privileged account, change these options back to normal and install a malicious plugin or theme containing a web shell or other malware to further infect the victim site.
Note: this vulnerability is being actively exploited in the wild.
Vulnerability exploitation has been spotted in the wild by WordPress website owners. The initial attack was first reported on October 13. The attackers used vulnerability in plugin to gain administrative privileges on the affected websites.
Software: WP GDPR Compliance
Use-after-free
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to a use-after free error in win32kfull!xxxDestroyWindow Win32k component. A local user can run a specially crafted application, trigger memory corruption and execute arbitrary code in kernel mode.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: the vulnerability has been actively exploited in the wild.
According to Kaspersky Lab, the vulnerability is being actively exploited by the FruityArmor APT actor.
Software: Windows
Known/fameous malware:
HEUR:Exploit.Win32.Generic
HEUR:Trojan.Win32.Generic
PDM:Exploit.Win32.Generic
Backdoor
VestaCP repository was compromised around May 2018 and contained malware at least until June 2018. As a result, user's credentials, generated by VestaCP, and other information were stolen by the attackers.
Software: Vesta Control Panel
Known/fameous malware:
Linux/ChachaDDoS
Spoofing attack
The vulnerability allows a remote attacker to conduct spoofing attack.
The weakness exists due to the way macOS processes URI handlers with enabled "Open Safe Files" setting in Safari browser. A remote attacker can create a specially crafted web page, trick the victim into clicking on a spoof dialog box and force unauthorized downloading of malicious file (e.g. ZIP-archive). Once downloaded, the archive will be automatically extracted.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability is being exploited in the wild by the WindShift APT actor against government organizations in the Middle East.
Software: Apple Safari
Information disclosure
The vulnerability allows a remote authenticated attacker to gain access to potentially sensitive information.
The vulnerability exists due to the way that the Windows SMB Server handles certain requests. A remote authenticated user can gain unauthorized access to sensitive information on the system.
Note: this vulnerability has being exploited in the wild. The exploit code was detected in the Bemstour exploit tool in September 2018 and has being used by Buckeye (APT3) APT group.
Software: Windows
Known/fameous malware:
Bemstour exploit tool
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to ALPC access control flaw. A local attacker can create a hard link from a readable file on the system to a '.job' file in the 'c:\windows\tasks' directory, invoke the _SchRpcSetSecurity() method of the task scheduler service ALPC endpoint to overwrite the linked file and gain system level privileges on the target system. The vulnerability was dubbed "SendboxEscaper".
Note: the vulnerability is being exploited in the wild by the PowerPool group.
Software: Windows
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to an error when validating file paths in Windows Shell. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary system commands on the vulnerable system.
Software: Windows
Use-after-free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a use-after-free error in VBScript when the scripting engine handles objects in memory in Internet Explorer. A remote unauthenticated attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: The vulnerability has been exploited in the wild.
The vulnerability was spotted in the wild by Trend Micro researcher on July 11, 2018. The exploit sample detected by the researchers was using the same obfuscation technique as exploits for CVE-2018-8174, spotted in the wild by Qihoo 360 in April 2018.
Software: Microsoft Internet Explorer
Known/fameous malware:
HTML_EXPLOIT.YYRV
The vulnerability was spotted in the wild by Trend Micro researcher on July 11, 2018. The exploit sample detected by the researchers was using the same obfuscation technique as exploits for CVE-2018-8174, spotted in the wild by Qihoo 360 in April 2018.
Links:
Stack-based buffer overflow
The vulnerability allows a remote attacker to compromise target system.
The vulnerability exists due to a stack-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow the attacker to compromise vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Software: Adobe Flash Player
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the AcubeFileCtrl.ocx ActiveX component. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the target system.
Note: this vulnerability is being actively exploited in the wild.
The South Korean CERT has reported in the wild exploitation of a remote code execution vulnerability in a popular ActiveX component. The group behind this attack is called Andariel Group. the group is tied to activity of a known North Korean adversary Lazarus Group.
Software: Samsung SDS Acube ActiveX Control
Links:
Cross-site request forgery
The vulnerability allows a remote attacker to perform CSRF attacks.Vulnerability exploitation was spotted by users of DrayTek routers. Attackers used CSRF vulnerability to change DNS settings of multiple routers to address: 38.134.121.95.
Software: DrayTek firmware
Links:
https://helpforum.sky.com/t5/Sky-Q/Sky-Q-and-Draytek-router/td-p/2835571
https://www.draytek.co.uk/support/security-advisories/kb-advisory-csrf-and-dns-dhcp-web-attacks
https://www.draytek.com/en/about/news/2018/notification-of-urgent-security-updates-to-draytek-router...
https://www.bleepingcomputer.com/news/security/draytek-router-zero-day-under-attack/
Double free memory error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.In March 2018 ESET detected attacks using two zero-day vulnerabilities in Microsoft win32k.sys driver (CVE-2018-8120) and and Adobe Acrobat.
Software: Adobe Acrobat DC
Known/fameous malware:
JS/Exploit.Pdfka.QNV trojan (ESET)
Buffer overflow
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to boundary error in win32k.sys driver. A local user can execute arbitrary code with SYSTEM privileges.
Note: this vulnerability is being actively exploited in limited targeted attacks.The vulnerability was reported by ESET in March 2018. The attackers used this vulnerability along with double free error in Adobe Acrobat CVE-2018-4990.
Software: Windows
Known/fameous malware:
Win32/Exploit.CVE-2018-8120.A trojan (ESET)
Improper input validation
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.The vulnerability exists due to an input validation error where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py. A remote attacker can send malicious messages and perform a denial of service attack.
Note: this vulnerability has been exploited in the wild in April 2018.
The attack was performed on Sunday, April 29 against #matrix:matrix.org and #matrix-dev:matrix.org that made the rooms temporarily unusable.
Software: Synapse
Integer overflow
The vulnerability allows a remote attacker to steal digital assets.
The vulnerability exists due to integer overflow within the transferFrom() function of a smart contract implementation for Useless Ethereum Token (UET). A remote attacker can steal assets (e.g., transfer all victims' balances into their account) because certain computations involving _value are incorrect.
The vulnerability was dubbed "transferFlaw" and has been exploited in the wild in December 2017.
This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. According to PeckShield this vulnerability has been already exploited in the wild since 2017/12/23 in multiple transactions.
Software: Useless Ethereum Token
Integer overflow
The vulnerability allows a remote attacker to manipulate digital assets.
The vulnerability exists due to integer overflow in a smart contract implementation for SmartMesh (aka SMT) within Ethereum ERC20 token. A remote unauthenticated attacker can increase digital assets via crafted _fee and _value parameter.
Note: the vulnerability was actively exploited in April 2018 and was dubbed "proxyOverflow".
Vulnerability exploitation was spotted on April 24 by a blockchain security startup PeckShield. As a result, OKEx has suspended all ERC-20 tokens.
Software: SmartMesh ERC20 token
Improper authentication
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was exploited against a very limited number of targets.
Software: MikroTik RouterOS
Integer overflow
The vulnerability allows a remote attacker to perform unauthorized actions.The vulnerability exploitation resulted in suspension of all BeautyChain (BEC) transactions.
Software: ERC-20
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Vulnerability exploitation was detected by Qihoo 360. The company uncovered a zero-day vulnerability in IE, dubbed тАШdouble playтАЩ, that was triggered by weaponized MS Office documents. The experts have been observing an APT group targeting a limited number of users exploiting the zero-day flaw.
Hackers can use the тАШdouble playтАЩ flaw to implant a backdoor Trojan and take full control over the vulnerable machine.
The APT group was delivering an Office document with a malicious web page embedded, once the user opens the document, the exploit code and malicious payloads are downloaded and executed from a remote server. The later phase of this attack leverages a public UAC bypass technique and uses file steganography and memory reflection loading to avoid traffic monitoring and achieve loading with no files. This тАШdouble playтАЩ vulnerability may affect the latest versions of Internet Explorer and applications that are with IE kernel.
For now most of the victims are located in Asia.
In May 2018 the vulnerability was added into the RIG exploit kit, after the PoC code became publicly available.
Software: Windows
Known/fameous malware:
RIG exploit kit
Improper authentication
The vulnerability allows a remote attacker to bypass authentication checks and gain full access to the affected system.The vulnerability was used to compromise hosting servers. The attack was reportedly performed from IP addresses, located in China.
This vulnerability triggered an outage of Digitalocean in NYC regions.
Software: Vesta Control Panel
Remote code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was used in the wild against PyBitmessage v0.6.2 users. According to vendor's notice, Bitmessage developer Peter ┼аurda's Bitmessage addresses were compromised as well by the attackers.
Software: PyBitmessage
Use-after-free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.KR-CERT reported in the wild exploitation of zero-day vulnerability in the latest version of Adobe Flash Player. According to the South Korean Computer Emergency Response Team (KR-CERT), the exploit has being used in the wild since mid-November 2017.
Security experts for FireEye linked the vulnerability to the hacking group TEMP.Reaper. The IP-addresses from which attacks were connected with the C&C-servers belong to the Internet provider Star JV - a joint venture of North Korea and Thailand.
Cisco Talos observed use of vulnerability in attacks conducted by Group 123.
According to FireEye, after successful exploitation of the vulnerability the system is infected with DOGCALL malware.
Cisco Talos specialists also reported cyberattacks using the malicious software, which they called Rokrat.
As revealed by security experts for Morphisec Labs Michael Gorelik and Assaf Kachlon the vulnerability has been used in a watering hole attack against Hong Kong Telecommunications company.
Software: Adobe Flash Player
Known/fameous malware:
DOGCALL
Rokrat
KR-CERT reported in the wild exploitation of zero-day vulnerability in the latest version of Adobe Flash Player. According to the South Korean Computer Emergency Response Team (KR-CERT), the exploit has being used in the wild since mid-November 2017.
Security experts for FireEye linked the vulnerability to the hacking group TEMP.Reaper. The IP-addresses from which attacks were connected with the C&C-servers belong to the Internet provider Star JV - a joint venture of North Korea and Thailand.
Cisco Talos observed use of vulnerability in attacks conducted by Group 123.
According to FireEye, after successful exploitation of the vulnerability the system is infected with DOGCALL malware.
Cisco Talos specialists also reported cyberattacks using the malicious software, which they called Rokrat.
As revealed by security experts for Morphisec Labs Michael Gorelik and Assaf Kachlon the vulnerability has been used in a watering hole attack against Hong Kong Telecommunications company.
Links:
https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998
https://www.bleepingcomputer.com/news/security/new-adobe-flash-zero-day-spotted-in-the-wild/
https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html
http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html
http://blog.morphisec.com/watering-hole-attack-hong-kong-telecom-site-flash-exploit-cve-2018-4878
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Microsoft Word
Command injection
The vulnerability allows a remote attacker with administrator privileges to perform command injection attack on the target system.The vulnerability has been used in Satori attacks against Huawei's router model HG532. The most targeted countries include the United States, Italy, Germany, and Egypt.
Software: Huawei HG532
Known/fameous malware:
Satori botnet, Mirai malware
Information disclosure
The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.Software: Roundcube
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error when processing .swf files. A remote unauthenticated attacker can create a specially crafted .swf file, trick the victim into opening it and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
According to Kaspersky Lab, the vulnerability has being exploited by the BlackOasis threat actor. The recent attacks leveraging today's zero-day sent malicious Office documents to victims, which came with an embedded ActiveX object that contained the Flash CVE-2017-11292 exploit.
Software: Adobe Flash Player
Known/fameous malware:
FINSPY
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness was reported to Microsoft by researchers at China-based security firm Qihoo 360. The experts said they first observed an attack exploiting this vulnerability on September 28. The attacks targeted a small number of the companyтАЩs customers and they involved malicious RTF files.
Software: Microsoft Office
Backdoor
CCleaner version 5.33.6162 and CCleaner Cloud version 1.07.3191 were shipped with a backdoor code from official vendorтАЩs website. The incident was detected on September 12.Avast reported a security breach, which involved compromise of one of the CCleaner distribution servers. As a result, the adversary was able to distribute a backdoored version of CCleaner application between August 15 and September 12. The compromised version of CCleaner was distributed from the official vendor's website.
Software: CCleaner
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to uncpecified error when processing untrusted input. A remote unauthenticated attacker can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability was detected by FireEye researchers. The attacker used Microsoft Office RTF document to leverage RCE in .NET Framework and deploy FINSPY malware. The malicious document тАЬ╨Я╤А╨╛╨╡╨║╤В.docтАЭ (MD5: fe5c4d6bb78e170abf5cf3741868ea4c) had Russian name and might have been used to target a Russian speaker.
Software: Microsoft .NET Framework
Known/fameous malware:
FINSPY
Backdoor
The vulnerability allows a remote attacker to gain complete control over affected system.A backdoor code was detected in NetSarang software on August 4, 2017. Next day, on August 5 the developer has released an update to resolve the issue. As of August 15, there is an evidence, that the code has being utilized by one instance in Hong Kong.
The malicious code was delivered to the vendor's clients by compromising the software update mechanism. The backdoor was included into updates, issued on July 18, 2017. The update contained ShadowPad backdoor.
Software: Xftp
Known/fameous malware:
ShadowPad backdoor
Race condition
The vulnerability allows a local user to execute arbitrary code with escalated privileges.Software: Linux kernel
Backdoor
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.The browser extension for Google Chrome has been hijacked on Google Web Store.
Software: Web Developer (Chrome extension)
Backdoor
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.The browser extension has been hijacked on Google Web Store.
Software: Copyfish (Chrome extension)
Backdoor
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.The browser extension was hijacked on July 3, 2017 and a backdoor was distributed via Google Web Store. The attackers have published non-existing version of the extension 20.1.1.
Software: Social Fixer (Chrome extension)
Backdoor
The security issue exists due to presence of backdoor code in updates, distributed from the official website. After update installation, the system becomes infected with NotPetya ransomware.The backdoor code was distributed via automatic update functionality. The infected version 10.01.189 contained backdoor code, which downloaded and installed NotPetya ransomware along with other tools, indented to distribute malware within local network. 75% of victims were located in Ukraine.
Software: M.E.Doc
Known/fameous malware:
NotPetya
The backdoor code was distributed via automatic update functionality. The infected version 10.01.189 contained backdoor code, which downloaded and installed NotPetya ransomware along with other tools, indented to distribute malware within local network. 75% of victims were located in Ukraine.
Security restrictions bypass
The vulnerability allows a remote attacker to bypass security restrictions on the target system.There are confirmed reports indicating that this vulnerability has been publicly exploited in spam campaigns. The attackers were creating accounts, uploading files with spam links to advertise or influence SEO rankings.
Software: Drupal
Backdoor
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.The browser extension was hijacked on Google Web Store. That update included alert10.js, malware that opens popups saying you have a virus.
Software: Chrometana (Chrome extension)
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when Windows Search handles objects in memory. A remote unauthenticated attacker can send specially crafted messages to the Windows Search service and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Software: Windows
Improper input validation
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to an error when processing .LNK files. A remote attacker can create a specially crafted .LNK file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability is being actively exploited in the wild.
Software: Windows
Backdoor
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.The browser extension was hijacked on Google Web Store. The injected script was displaying and advertisement via alert10.js script, informing victims that their PC has been infected with malware and suggesting to purchase fake antivirus.
Software: Infinity New Tab (Chrome extension)
Buffer overflow
The vulnerability allows a remote attacker to compromise vulnerable system.The vulnerability was disclosed by the Shadow Brokers hacking team.
Software: Windows
Known/fameous malware:
EsteemAudit
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error when processing EPS wiles within Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current victim.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability was used by APT28 team along with another zero-day CVE-2017-0263.
Software: Microsoft Office
Known/fameous malware:
GAMEFISH
Elevation of privilege
The vulnerability allows a local user to elevate privileges on the system.
The vulnerability exists due to boundary error in Win32k.sys driver. A local user can escalate privileges on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
The vulnerability was used by APT28 team along with another zero-day CVE-2017-0262.
Software: Windows
Known/fameous malware:
GAMEFISH
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution.Software: Microsoft Internet Explorer
Improper access control
The vulnerability allows a remote attacker to compromise vulnerable device.
The vulnerability exists due to unknown error, which leads to QNAP device compromise. Vulnerability details are not disclosed yet.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.
Note: the vulnerability is being actively exploited in the wild.
QNAP reported a security issue involving unauthorized access to the QNAP devices. Several QNAP NAS devices running QTS have been injected with XMR mining programs, specifically from mineXMR.com.
Software: QNAP QTS
Type confusion
The vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on a targeted system.Software: Ghostscript
Stack-based buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing mailbox names in the EXAMINE IMAP command. A remote authenticated attacker can send an EXAMINE IMAP command containing an overly long mailbox name, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability has been exploited in the wild and was disclosed by the Shadow Brokers leak.
The list of affected products, according to software vendor:
The exploit code was disclosed by the Shadow Brokers leak.
Software: IBM Domino
Known/fameous malware:
EMPHASISMINE exploit
Use-after-free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a use-after-free error when processing EPS images within Microsoft Office files. A remote attacker can create a specially crafted Office file with malicious EPS image, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability was used by Turla and an unknown financially motivated actor.
Software: Microsoft Office
Known/fameous malware:
SHIRIME
NETWIRE
Links:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/2017-2605
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0261
https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
https://blogs.technet.microsoft.com/msrc/2017/05/09/coming-together-to-address-encapsulated-postscri...
Cross-domain scripting
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability is caused by incorrect filtration of input data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victimтАЩs browser in security context of another domain.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Note: this vulnerability is being exploited in the wild.
Software: Microsoft Internet Explorer
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it with Microsoft Office or WordPad and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in compromise vulnerable system.
Note: the vulnerability is being actively exploited.
The detected samples are organized as Word files containing Dridex botnet ID 7500 (more specially, RTF files with тАЬ.docтАЭ extension name). The exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10. The earliest attack dates to late January, according to McAfee.
According to FireEye, the malware leveraging this vulnerability was used to target Russian-speaking victims. As early as Jan. 25, 2017, lure documents referencing a Russian Ministry of Defense decree and a manual allegedly published in the "Donetsk People's Republic" exploited CVE-2017-0199 to deliver FINSPY payloads.
This vulnerability was also used by Patya.A ransomware in malware outbreak on 27 June, 2017 as one of the attack vectors.
Software: Microsoft Office
Known/fameous malware:
Malware.Binary.Rtf
Dridex botnet
FINSPY
LATENTBOT
Petya.A
Links:
https://securingtomorrow.mcafee.com/mcafee-labs/critical-office-zero-day-attacks-detected-wild/
https://www.fireeye.com/blog/threat-research/2017/04/acknowledgement_ofa.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in ScStoragePathFromUrl() function in the WebDAV service when processing overly long HTTP header beginning with "If: <http://" in a PROPFIND request. A remote unauthenticated attacker can trigger buffer overflow and execute arbitrary code on the target system with privileges of the IIS service.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability is being actively exploited in the wild in July and August 2016.
There are reports that this vulnerability is being actively exploited in the wild against legacy installations of Microsoft IIS 6.0 in July and August 2016. At the time of publication the product was no longer supported by the vendor. However Microsoft has decided to release a security patch to address this issue on June 13, 2017.
Software: Microsoft IIS
Known/fameous malware:
EXPLODINGCAN
There are reports that this vulnerability is being actively exploited in the wild against legacy installations of Microsoft IIS 6.0 in July and August 2016. At the time of publication the product was no longer supported by the vendor. However Microsoft has decided to release a security patch to address this issue on June 13, 2017.
Spoofing attack
The vulnerability allows a remote attacker to perform spoofing attack.The vulnerability exists due to improper parsing of right-to-left override (RLO) character when processing names of the transmitted files in Telegram Desktop for Windows. A remote attacker can create a specially crafted filename with malicious content (e.g. a JavaScript file), disguise it as an image and trick the victim into opening it.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability has been exploited in the wild since March until October in 2017, according to Kaspersky Lab and was silently fixed by the vendor.
According to Kaspersky Lab, this vulnerability was exploited in the wild since March 2017 until October 2017. The attackers used the vulnerability to install cryptocurrency miners on victimsтАЩ computers.
Software: Telegram Desktop for Windows
According to Kaspersky Lab, this vulnerability was exploited in the wild since March 2017 until October 2017. The attackers used the vulnerability to install cryptocurrency miners on victimsтАЩ computers.
Improper input validation
The vulnerability allows a remote attacker to gain access to vulnerable device.
The vulnerability exists due to improper input validation in Cisco Cluster Management Protocol (CMP) implementation and failure to restrict usage of CMP-specific Telnet options only to internal, local communications between cluster members. A remote unauthenticated attacker can send specially crafted CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections and cause the affected device to reload or obtain full control over vulnerable device.
Successful exploitation of this vulnerability may allow an attacker to gain full access to vulnerable device.
Note: information about this vulnerability was publicly disclosed by WikiLeaks documents dubbed CIA Vault 7.
The vulnerability was disclosed by WikiLeaks in documents dubbed CIA Vault 7. It is believed that this vulnerability was used by CIA agents to penetrate government and corporate networks.
Software: Cisco IOS
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.
It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.
Software: Windows
Known/fameous malware:
EternalSynergy exploit
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.
It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.
This vulnerability was used to spread WannaCry and NotPetya ransomwere.
Software: Windows
Known/fameous malware:
EternalRomance exploit
WannaCry
NotPetya
Information disclosure
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and gain access to potentially sensitive data.
Successful exploitation of this vulnerability may allow an attacker to gain access to potentially sensitive information.
Note: this vulnerability has been exploited in the wild and is publicly known as EternalChampion exploit.
On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.
Software: Windows
Known/fameous malware:
EternalChampion exploit
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability has been exploited in the wild and is publicly known as EternalChampion exploit.
On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.
Software: Windows
Known/fameous malware:
EternalChampion exploit
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.
It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.
On May 12, 2017 the malicious team has hit over 100,000 organizations in 150 countries. The hackers encrypted files from the target system and demanded 300-600$.
Software: Windows
Known/fameous malware:
WannaCry (Wana Decryptor) malware (the hackers added .WCRY extention to the targte files). The malware is believed to be connected to Lazarus Group from North Korea.
EternalBlue exploit.
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges on the target system.The vulnerability was used by Zirconium cyber-espionage group against older versions of Windows.
Software: Windows
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to improper handling of objects in memory by Microsoft XML Core Services (MSXML). A remote unauthenticated attacker can create a specially crafted Web site, trick the victim into visiting it and test for the presence of files on disk.
Successful exploitation of this vulnerability results in information disclosure.
Note: the vulnerability was being actively exploited.
This vulnerability was used in the AdGholas malvertising campaign and later integrated into the Neutrino exploit kit. The vulnerability was reported to Microsoft in September 2016. The first malware sample, discovered in the wild, is connected with AdGholas campaign in July 2016. The exploit came back again in September 2016 with the Neutrino exploit kit.
Software: Microsoft XML Core Services
Known/fameous malware:
Neutrino exploit kit
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when accessing objects in memory. A remote unauthenticated attacker can create a specially crafted web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Software: Microsoft Internet Explorer
Stack-based buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Remote code execution exploit was revealed during Vault 7 leak. It is possible, that this vulnerability was used to compromise Mikrotik routers in Slingshot APT campaign.
Software: MikroTik RouterOS
Known/fameous malware:
ChimayRed
Backdoor
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.The browser extension was hijacked on Google Web Store. The attackers were able to distributed malware to the extension user's. The attack occurred around March 1, 2017.
Software: Web Paint (Chrome extension)
Format string vulnerability
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a format string error within cgiemail and cgiecho binaries when processing template files. A remote authenticated attacker can create a specially crafted file, containing form string specifiers and execute arbitrary code on the target system.
Successful exploitation may allow an attacker to compromise vulnerable system.
Note: this vulnerability has been exploited in the wild and was disclosed by the Shadow Brokers leak. The exploit is known as ElegantEagle.
The exploit code was disclosed by the Shadow Brokers leak dubbed ElegantEagle, exploiting vulnerability in cgiemail.
Software: cPanel
Known/fameous malware:
ElegantEagle exploit
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted SWF file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Software: Adobe Flash Player
Use-after-free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error when processing SVG animation in nsSMILTimeContainer::NotifyTimeChange() function. A remote attacker can create a specially crafted web page, host malicious SVG file on it and execute arbitrary code on vulnerable system.
Successful exploitation may allow an attacker to gain complete control over vulnerable system.
Note: this vulnerability is being publicly exploited against Tor Browser users.
Exploited in the wild against TOR Browser users. Exploit code was publicly disclosed as well before Mozilla released the patch.
Software: Tor Browser
Links:
https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/
https://www.mozilla.org/en-US/thunderbird/45.5.1/releasenotes/
http://blog.morphisec.com/tor/firefox-zero-day-prevented-by-morphisec
http://news.softpedia.com/news/mozilla-patches-svg-animation-remote-code-execution-in-firefox-and-th...
https://blog.malwarebytes.com/threat-analysis/2016/11/tor-browser-zero-day-strikes-again/
https://nakedsecurity.sophos.com/2016/12/01/firefox-and-tor-users-update-now-0-day-exploit-in-the-wi...
http://news.softpedia.com/news/mozilla-patches-svg-animation-remote-code-execution-in-firefox-and-th...
http://www.digitalriser.com/serious-firefox-tor-browser-vulnerability.html
https://www.helpnetsecurity.com/2016/12/01/firefox-tor-browser-0-day-patched/
https://arstechnica.com/security/2016/11/tor-releases-urgent-update-for-firefox-0day-thats-under-act...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=23741
http://thehackernews.com/2016/11/firefox-tor-update.html
http://www.eweek.com/security/mozilla-patches-zero-day-flaw-in-firefox.html
LDAP injection
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Jenkins
Memory Corruption
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory in Windows font library when processing Open Type fonts. A remote attacker can create a specially crafted font file and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
Note: this vulnerability is being actively exploited in the wild.
The vulnerability started to appear on the radar in June 2016 as it was used in "low-volume attacks primarily focused on targets in South Korea". A successful attack exploited a flaw in the Windows font library to elevate privileges, and to install a backdoor on target systems called Hankray.
Software: Windows
Known/fameous malware:
Trojan Horse Exp.CVE-2016-7256.
Links:
https://technet.microsoft.com/library/security/ms16-132
https://www.symantec.com/security_response/writeup.jsp?docid=2017-011706-2200-99
http://www.securityweek.com/microsoft-patches-windows-zero-day-exploited-russian-hackers
http://www.netsec.news/patch-tuesday-sees-68-microsoft-vulnerabilities-fixed/
https://www.ghacks.net/2017/01/18/microsoft-windows-10-hardening-against-0-day-exploits/
http://www.removesoft-tips.com/exp-cve-2016-7256-removal-guide-how-do-i-remove-exp-cve-2016-7256-com...
https://hotforsecurity.bitdefender.com/blog/if-youre-going-to-use-windows-it-makes-security-sense-to...
http://www.digitaltrends.com/computing/anniversary-update-shielded-against-two-exploits/
http://www.thewindowsclub.com/windows-10-mitigate-zero-day-exploits
http://windowsreport.com/microsoft-windows-10-zero-day-exploit/
Privilege escalation
The vulnerability allows a local user to gain elevated privileges on the target system.
The weakness is due to improper handling of objects in memory by win32k.sys. By sending a specially crafted system call NtSetWindowLongPtr(), a local attacker can set index GWLP_ID to WS_CHILD value on a window handle with GWL_STYLE and execute arbitrary code with system privileges.
Successful explotation of the vulnerability results in privilege escalation.
Note: this vulnerability is being actively exploited in the wild.
The zero-day was being actively exploited by Russian hackers (APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, and Sofacy).
Software: Windows
Links:
https://www.symantec.com/security_response/writeup.jsp?docid=2016-110821-3527-99
https://technet.microsoft.com/library/security/ms16-135
https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html
http://www.netsec.news/patch-tuesday-sees-68-microsoft-vulnerabilities-fixed/
https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerab...
http://securityaffairs.co/wordpress/53242/hacking/cve-2016-7255-zero-day.html
http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-72...
https://cyware.com/news/one-bit-to-rule-a-system-analyzing-cve-2016-7255-exploit-in-the-wild-84cb5e1...
http://www.darkreading.com/endpoint/microsoft-november-security-updates-include-fix-for-zero-day-fla...
https://www.grahamcluley.com/pawn-storm-microsoft-zero-day/
https://nakedsecurity.sophos.com/2016/11/09/november-patch-tuesday-fixes-controversial-windows-0-day...
http://sensorstechforum.com/cve-2016-7255-67-vulnerabilities-addressed-microsoft/
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error when handling .swf files. A remote attacker can trick the victim to visit a website or open a file with malicious Flash file and execute arbitrary code on the target system with privileges of the current user.
Note: this vulnerability was being actively exploited in the wild.
The vulnerability was disclosed by Neel Mehta and Billy Leonard of the Google Threat Analysis Group.
The vulnerability was exploited by Russian hacker group APT28.
Software: Adobe Flash Player
Links:
https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html https://helpx.adobe.com/security/products/flash-player/apsb16-36.html https://technet.microsoft.com/library/security/ms16-128
https://threatpost.com/adobe-patches-flash-zero-day-under-attack/121567/
http://securityaffairs.co/wordpress/52739/hacking/cve-2016-7855-adobe.html
http://sensorstechforum.com/cve-2016-7855-flash-bug-exploited-limited-attacks/
http://www.securityweek.com/adobe-patches-flash-vulnerability-used-targeted-attacks
http://thehackernews.com/2016/10/google-windows-zero-day.html
http://opensources.info/cve-2016-7855-flaw-in-adobe-flash-player-exploited-in-targeted-attacks/
https://www.infosecurity-magazine.com/news/flash-windows-zerodays-are-being/
https://fossbytes.com/microsoft-windows-zero-day-vulnerability-google-told-people/
https://www.theregister.co.uk/2016/10/26/adobe_patches_fresh_flash_zeroday/
https://www.symantec.com/connect/blogs/flash-zero-day-being-exploited-targeted-attacks
http://www.pcworld.com/article/3135715/security/emergency-flash-player-patch-fixes-zero-day-critical...
http://thecharlestendellshow.com/microsoft-patches-cve-2016-7255-windows-zero-day-exploited-by-fancy...
https://arstechnica.com/security/2016/11/fancy-bear-goes-all-out-to-beat-adobe-msft-zero-day-patches...
Privilege escalation
The vulnerability allows a local user to obtain elevated privileges on the target system.The vulnerability was discovered by security researcher Phil Oester and is called "DIRTY COW".
It is believed that the vulnerability was being exploited in the wild for quite some time.
Software: Linux kernel
Links:
https://cdn.kernel.org/pub/linux/kernel/v4.x/testing/linux-4.9-rc2.tar.xz
https://dirtycow.ninja/
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05352241
https://en.wikipedia.org/wiki/Dirty_COW
http://unix.stackexchange.com/questions/317981/dirty-cow-exploit-cve-2016-5195/318046
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
http://www.techinformant.in/dirty-cow-cve-2016-5195-vulnerability/
http://thehackernews.com/2016/10/linux-kernel-exploit.html
http://news.softpedia.com/news/linux-kernel-zero-day-cve-2016-5195-patched-after-being-deployed-in-l...
http://securityaffairs.co/wordpress/52521/hacking/dirty-cow-exploit.html
http://www.informationsecuritybuzz.com/expert-comments/dirty-cow-linux-vulnerability/
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.Proofpoint researchers Will Metcalf and Kafeine first detected and reported CVE-2016-3298 in April 2016 as part of a тАЬGooNkyтАЭ infection chain along with CVE-2016-3351, but the information disclosure vulnerability was most likely already in use by the AdGholas group.
CVE-2016-3298 and CVE-2016-3351 were reported to Microsoft between October and December of 2015.
Software: Microsoft Internet Explorer
Known/fameous malware:
Exploit Kit: Neutrino
Links:
https://www.proofpoint.com/uk/threat-insight/post/microsoft-patches-CVE-2016-3298-second-information...
https://technet.microsoft.com/en-us/library/security/ms16-118.aspx
https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2016-3298-microsoft-fixes-another-ie...
http://securityaffairs.co/wordpress/52186/hacking/microsoft-zero-da.html
https://www.brokenbrowser.com/detecting-local-files-to-evade-analysts/
https://threatpost.com/microsoft-patches-five-zero-days-under-attack/121211/
https://www.scmagazine.com/patch-tuesday-microsoft-patches-five-zero-day-vulnerabilities/article/548...
http://thehackernews.com/2016/10/Microsoft-security-patch-updates.html
https://blog.malwarebytes.com/cybercrime/exploits/2016/08/browser-based-fingerprinting-implications-...
http://www.securityweek.com/attackers-use-internet-explorer-zero-day-avoid-researchers
http://news.softpedia.com/news/microsoft-patches-four-zero-days-used-in-live-attacks-509222.shtml
http://wccftech.com/zero-day-exploited-update-windows-right-away/
https://www.beencrypted.com/attackers-uses-ie-edge-zero-day-avoid-researchers/
Arbitrary code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability has been used by an APT group Kaspersky Lab call FruityArmor. Victims have been identified in Thailand, Iran, Algeria, Yemen, Saudi Arabia and Sweden.
Software: Windows
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Microsoft Edge
Links:
https://technet.microsoft.com/library/security/ms16-119
https://threatpost.com/microsoft-patches-five-zero-days-under-attack/121211/
http://thehackernews.com/2016/10/Microsoft-security-patch-updates.html
http://www.securitynewspaper.com/2016/10/12/microsoft-patches-four-zero-days-used-live-attacks/
http://www.securityweek.com/microsoft-patches-4-vulnerabilities-exploited-wild
https://www.tripwire.com/state-of-security/vulnerability-management/vert-threat-alert-october-2016-p...
http://www.slideshare.net/LANDESK/october2016-patchtuesdayshavlik
http://www.zdnet.com/article/microsoft-hackers-have-exploited-zero-days-in-windows-10s-edge-office-i...
https://www.helpnetsecurity.com/2016/10/12/october-patch-tuesday/
http://www.dailystar.co.uk/tech/news/553358/Microsoft-Windows-10-critical-flaws-security-update-fix-...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Microsoft Word
Links:
https://technet.microsoft.com/en-us/library/security/ms16-121.aspx
http://thehackernews.com/2016/10/Microsoft-security-patch-updates.html
https://threatpost.com/microsoft-patches-five-zero-days-under-attack/121211/
https://www.symantec.com/security_response/vulnerability.jsp?bid=93372
http://thehackernews.com/2016/10/Microsoft-security-patch-updates.html
http://www.securitynewspaper.com/2016/10/12/microsoft-patches-four-zero-days-used-live-attacks/
http://www.networkworld.com/article/3130109/security/microsoft-released-10-patches-6-rated-critical-...
https://www.scmagazine.com/patch-tuesday-microsoft-patches-five-zero-day-vulnerabilities/article/548...
http://www.zdnet.com/article/microsoft-hackers-have-exploited-zero-days-in-windows-10s-edge-office-i...
http://securityaffairs.co/wordpress/52186/hacking/microsoft-zero-da.html
https://www.helpnetsecurity.com/2016/10/12/october-patch-tuesday/
https://www.scmagazineuk.com/microsoft-bundles-security-updates--no-more-pick-and-choose/article/547...
Information disclosure
The vulnerability allows a remote user to access potentially sensitive information on the target system.
The weakness exists due to insufficient checks of IKE packats when handling ISAKMP requests. By sending specially crafted IKEv1 packets to the IKE service via IPv4 or IPv6 a malicious user can obtain memory contents.
Successful exploitation of the vulnerability leads to confidential information disclosure on the vulnerable system.
Note: this vulnerability was being actively exploited in the wild. It was disclosed as part of Equation Group Leak and is reffered as BENIGNCERTAIN exploit.
The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group on Saturday 13 August 2016. The exploit code was dubbed BENIGNCERTAIN and presumably was used by NSA operatives to infiltrate networks of government organizations and private companies.
Neither Cisco has developed a patch for the flaw, nor any workarounds are available.
Software: Cisco IOS
Known/fameous malware:
BENIGNCERTAIN
Links:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1
http://thehackernews.com/2016/09/cisco-nsa-exploit.html
https://threatpost.com/cisco-warns-of-ios-flaw-vulnerable-to-shadowbrokers-attack/120668/
https://www.tecklyfe.com/ikev1-information-disclosure-vulnerability-multiple-cisco-products/
http://www.securityweek.com/cisco-finds-new-zero-day-linked-shadow-brokers-exploit
http://bestsecuritysearch.com/vulnerability-ikev1-cisco-products/
http://searchsecurity.techtarget.com/news/450304648/Shadow-Brokers-Cisco-vulnerability-exploited-in-...
https://www.grahamcluley.com/cisco-customers-targeted-hackers-using-leaked-nsa-hacking-tools/
https://www.enisa.europa.eu/publications/info-notes/the-201cshadow-brokers201d-story
http://thecharlestendellshow.com/over-840000-cisco-systems-affected-by-the-equation-groups-flaw-cve-...
https://www.scmagazine.com/cisco-warns-of-exploitation-of-new-flaws-linked-to-shadow-brokers-exploit...
https://plannedlink.co.uk/2016/09/20/cve-2016-6415-cisco-confirms-a-new-0day-linked-to-equation-grou...
http://securityaffairs.co/wordpress/51410/hacking/cve-2016-6415.html
https://motherboard.vice.com/en_us/article/hackers-hit-cisco-customers-leaked-nsa-hacking-tools-shad...
http://www.hackbusters.com/news/stories/858203-cisco-ikev1-information-disclosure-benigncertain-cve-...
http://news.softpedia.com/news/shadow-brokers-beningcertain-tool-deployed-in-live-attacks-508455.sht...
http://www.securityinform.com/2016/09/22/859-000-cisco-devices-affected-by-critical-zero-day-vulnera...
Memory corruption
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to boundary error when handling of malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and gain access to arbitrary data.
Microsoft has known about CVE-2016-3351 since 2015.
Exploited By AdGholas and GooNky Malvertising Groups.
Software: Microsoft Internet Explorer
Links:
https://www.proofpoint.com/us/threat-insight/post/Microsoft-Patches-Zero-Day-Exploited-By-AdGholas-G...
https://technet.microsoft.com/library/security/ms16-104
https://technet.microsoft.com/library/security/MS16-105
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=29628
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2016-3298-microsoft-fixes-another-ie-...
http://securityaffairs.co/wordpress/51494/hacking/internet-explorer-exploits.html
http://wccftech.com/zero-day-exploited-update-windows-right-away/
https://www.brokenbrowser.com/detecting-local-files-to-evade-analysts/
http://www.securityweek.com/microsoft-patches-browser-vulnerability-exploited-attacks
https://www.scmagazineuk.com/microsoft-bundles-security-updates--no-more-pick-and-choose/article/547...
http://www.securingcomputer.com/news/microsoft-patches-browser-vulnerability-exploited-attacks
http://www.zdnet.com/article/microsoft-patches-critical-ie-bug-that-was-under-attack-for-nearly-thre...
http://techgenix.com/microsoft-patches-ie-malvertising-vulnerability/
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists within text processor when parsing .inp files. A remote attacker can create a specially crafted .inp file, trick the victim to open it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in full system compromise.
Note: this vulnerability is being actively exploited in the wild against financial institutions in Asia. The latest attack report is dated November 3, 2017.
Exploit code was used in targeted attacks against financial institutions in Asia. Victims of these attacks have been observed in U.K., U.S, Myanmar, Sri-Lanka and Uganda. The sector for the victims include both financial and governmental institutions.
Attacks are similar to attacks exploiting vulnerabilities in the Hangul Word Processor against government targets in South Korea.
UPDATE
Researchers from Palo Alto Networks published a write-up on November 2 2017, describing 3 latest exploits, leveraging this particular vulnerability.
The decoy documents used by the InPage exploits in the latest attacks suggest that the targets are likely to be politically or militarily motivated. They contained subjects such as intelligence reports and political situations related to India, the Kashmir region, or terrorism being used as lure documents.
Software: InPage
Known/fameous malware:
Zeus-type malware
CONFUCIUS_B
Links:
https://securelist.com/blog/research/76717/inpage-zero-day-exploit-used-to-attack-financial-institut...
https://threatpost.com/inpage-zero-day-used-in-attacks-against-banks/122112/
http://www.securityweek.com/organizations-asia-targeted-inpage-zero-day
http://securityaffairs.co/wordpress/53725/intelligence/inpage-zero-day.html
http://techgenix.com/banks-hacked-via-inpage/
https://www.theregister.co.uk/2016/11/24/attackers_use_yearsold_software_zero_day_to_pop_asia_pac_ba...
http://www.itnewsafrica.com/2016/11/asian-and-african-banks-are-attacked-using-a-zero-day-vulnerabil...
https://cyware.com/news/organizations-in-asia-targeted-with-inpage-zero-day-37293662
https://frederickdamasus.com/2016/11/zero-day-attacks-african-asian-banks.html/
https://thetechportal.com/2016/11/24/banks-attacked-zero-day-kaspersky/
http://technewsdir.com/asian-and-african-banks-attacked-using-a-zero-day-vulnerability-kaspersky
https://researchcenter.paloaltonetworks.com/2017/11/unit42-recent-inpage-exploits-lead-multiple-malw...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error in WebKit. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: the vulnerability was being actively exploited.
The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).
Software: Apple iOS
Known/fameous malware:
Trident exploit.
Links:
http://www.securityweek.com/apple-issues-emergency-fix-ios-zero-days-what-you-need-know
https://www.symantec.com/connect/blogs/trident-trio-ios-zero-days-being-exploited-wild
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
https://jndok.github.io/2016/10/04/pegasus-writeup/
https://blog.lookout.com/blog/2016/08/25/trident-pegasus/
http://securityaffairs.co/wordpress/50788/mobile-2/ios-9-3-4-trident-exploit.html
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
https://en.wikipedia.org/wiki/Pegasus_(spyware)
http://indianexpress.com/article/technology/tech-news-technology/apple-ios-trident-exploit-all-you-n...
http://www.technewsworld.com/story/83845.html
http://www.eweek.com/security/apple-rushes-out-patch-for-new-ios-zero-day-flaws.html
http://www.darkreading.com/vulnerabilities---threats/apple-releases-patch-for-trident-a-trio-of-ios-...
Memory corruption
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to a boundary error when processing a malicious application. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with SYSTEM privileges.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability was being actively exploited.
The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).
Software: Apple iOS
Known/fameous malware:
Trident exploit.
Links:
http://www.securityweek.com/apple-issues-emergency-fix-ios-zero-days-what-you-need-know
https://www.symantec.com/connect/blogs/trident-trio-ios-zero-days-being-exploited-wild
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
https://jndok.github.io/2016/10/04/pegasus-writeup/
https://blog.lookout.com/blog/2016/08/25/trident-pegasus/
http://securityaffairs.co/wordpress/50788/mobile-2/ios-9-3-4-trident-exploit.html
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
https://en.wikipedia.org/wiki/Pegasus_(spyware)
http://indianexpress.com/article/technology/tech-news-technology/apple-ios-trident-exploit-all-you-n...
http://www.technewsworld.com/story/83845.html
http://www.eweek.com/security/apple-rushes-out-patch-for-new-ios-zero-day-flaws.html
http://www.darkreading.com/vulnerabilities---threats/apple-releases-patch-for-trident-a-trio-of-ios-...
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper input validation. A remote attacker can run a specially crafted application, bypass security restrictions and obtain portions of kernel memory.
Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).
Software: Apple iOS
Known/fameous malware:
Trident exploit.
Links:
https://support.apple.com/en-us/HT207107
http://www.securityweek.com/apple-issues-emergency-fix-ios-zero-days-what-you-need-know
https://www.symantec.com/connect/blogs/trident-trio-ios-zero-days-being-exploited-wild
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
https://jndok.github.io/2016/10/04/pegasus-writeup/
https://blog.lookout.com/blog/2016/08/25/trident-pegasus/
http://securityaffairs.co/wordpress/50788/mobile-2/ios-9-3-4-trident-exploit.html
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/
https://en.wikipedia.org/wiki/Pegasus_(spyware)
http://indianexpress.com/article/technology/tech-news-technology/apple-ios-trident-exploit-all-you-n...
http://www.technewsworld.com/story/83845.html
http://www.eweek.com/security/apple-rushes-out-patch-for-new-ios-zero-day-flaws.html
http://www.darkreading.com/vulnerabilities---threats/apple-releases-patch-for-trident-a-trio-of-ios-...
CLI parser buffer overflow
The vulnerability allows a local user to cause denial of service or execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the command-line interface (CLI) parser. A local authenticated user can trigger buffer overflow and reload the affected device or execute arbitrary code on the target system.
Successful exploitation of this vulnerability will allow a local user to execute arbitrary code on vulnerable system.
The following models of CISCO ASA appliances are affected:
Note: this is a zero-day vulnerability, discovered after security breach of The Equation Group. The exploit code for this vulnerability was publicly exposed and is referred as EPICBANANA Exploit.
The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group in 2013. The exploit code was dubbed BENIGNCERTAIN and presumably was used by NSA operatives to infiltrate networks of government organizations and private companies
Neither Cisco has developed a patch for the flaw, nor any workarounds are available.
Firstly the vulnerability received a patch back in 2011.
Software: Cisco PIX Firewall
Known/fameous malware:
EPICBANANA.
Links:
https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
https://blogs.cisco.com/security/shadow-brokers
http://www.thesecurityblogger.com/the-shadow-brokers-epicbananas-and-extrabacon-exploits/
https://www.tripwire.com/state-of-security/latest-security-news/cisco-confirms-two-exploits-found-in...
https://www.bleepingcomputer.com/news/security/researchers-find-strong-connection-between-nsa-hacker...
http://thehackernews.com/2016/08/nsa-hack-exploit.html
http://news.softpedia.com/news/cisco-patches-zero-day-exposed-in-shadow-brokers-leak-507410.shtml
https://arstechnica.com/security/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-fo...
https://www.symantec.com/connect/blogs/equation-has-secretive-cyberespionage-group-been-breached
https://www.helpnetsecurity.com/2016/08/18/cisco-fortinet-exploits-leaked/
http://techgenix.com/nsa-hack-cisco-releases-patches/
https://www.riskbasedsecurity.com/2016/08/the-shadow-brokers-lifting-the-shadows-of-the-nsas-equatio...
http://www.eweek.com/security/shadow-brokers-flaw-poses-zero-day-risks-cisco-and-fortinet-warn.html
https://duo.com/blog/newly-released-exploits-affect-cisco-juniper-and-other-vendors
SNMP remote code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when handling SNMP packets. A remote attacker with knowledge of SNMP community string can cause buffer overflow and cause the target device to reload or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in full compromise of affected system.
The following models of CISCO ASA appliances are affected:
Note: this is a zero-day vulnerability, discovered after security breach of The Equation Group. The exploit code for this vulnerability was publicly exposed and is referred as EXTRABACON Exploit.
The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group in 2013. The exploit code was dubbed ExtraBacon and presumably used by NSA operatives to infiltrate networks of government organizations and private companies.
Software: Cisco ASA Series
Known/fameous malware:
ExtraBacon.
Links:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp
https://www.surecloud.com/security-bulletins/cisco-asa-pix-firewall-zero-day-vulnerability-cve-2016-...
http://securityaffairs.co/wordpress/51410/hacking/cve-2016-6415.html
https://threatpost.com/cisco-begins-patching-equation-group-asa-zero-day/120124/
http://www.bankinfosecurity.com/cisco-patches-asa-devices-against-extrabacon-a-9360
http://news.softpedia.com/news/cisco-patches-zero-day-exposed-in-shadow-brokers-leak-507410.shtml
https://threatpost.com/leaked-shadowbrokers-attack-upgraded-to-target-current-versions-of-cisco-asa/...
https://arstechnica.com/security/2016/08/cisco-confirms-nsa-linked-zeroday-targeted-its-firewalls-fo...
ttps://thehackernews.com/2016/08/nsa-hack-exploit.html
https://duo.com/blog/newly-released-exploits-affect-cisco-juniper-and-other-vendors
http://www.securityweek.com/cisco-finds-new-zero-day-linked-shadow-brokers-exploit
https://www.symantec.com/connect/blogs/equation-has-secretive-cyberespionage-group-been-breached
https://www.helpnetsecurity.com/2016/08/18/cisco-fortinet-exploits-leaked/
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exist due to a boundary error within cookie parser. A remote attacker can send a specially crafted HTTP request, cause memory corruption and execute arbitrary code on vulnerable system.
Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to vulnerable system.
Note:the vulnerability was being actively exploited.
Information about zero-day vulnerabilities in Cisco and FortiOS products was exposed after NSA data leak in August 2016. The tools bear digital signatures that match those used by the Equation Group, a group that has alleged links to the NSA. The incident highlights the risk of hoarding zero-day vulnerabilities.
EGREGIOUSBLUNDER is one of multiple Equation Group vulnerabilities and exploits disclosed on 2016/08/14 by a group known as the Shadow Brokers.
Software: FortiOS
Links:
http://fortiguard.com/advisory/FG-IR-16-023
http://www.computerworld.com/article/3109307/security/cisco-and-fortinet-issue-patches-against-nsa-m...
https://www.sans.org/newsletters/newsbites/xviii/66#201
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/vulnerability/7381/fortinet-fortigate-cookie...
http://netformation.com/level-3-pov/shadow-brokers-hit-the-light-of-day
https://vulners.com/nessus/FORTIOS_COOKIE_PARSING_BOF.NASL
https://www.riskbasedsecurity.com/2016/08/the-shadow-brokers-lifting-the-shadows-of-the-nsas-equatio...
https://tools.cisco.com/security/center/viewAlert.x?alertId=48526
https://www.tenable.com/plugins/index.php?view=single&id=93196
Security bypass
The vulnerabiity allows a remote attacker to bypass security restrictions on the target system.In August 2016 Mozilla bug-tracking service was hacked. Hackers were able to steal information about not yet patched vulnerabilities in Mozilla Firefox and use one of them in a targeted attack against users of Russian news website.
The malicious exfiltration server, hosted in Ukraine, has been online since July 27, 2015.
The vulnerability was reported by researcher Cody Crews.
Software: Mozilla Firefox
Known/fameous malware:
JS/Exploit.CVE-2015-4495 (ESET).
Links:
http://www.computerworld.com/article/2980745/web-browsers/mozilla-admits-bug-tracker-breach-led-to-a...
https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/
https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-latest-0-day-attack/
http://www.securityweek.com/mozilla-patches-firefox-zero-day-exploited-wild
https://www.redpacketsecurity.com/firefox-0day-cve-2015-4495/
https://access.redhat.com/articles/1563163
https://www.symantec.com/connect/blogs/firefox-vulnerability-could-allow-attackers-steal-documents
http://securityaffairs.co/wordpress/39198/cyber-crime/0-day-firefox.html
https://www.hedgehogsecurity.co.uk/firefox-users-should-update-immediately/
https://www.eset.com/int/about/newsroom/company/firefox-0-day-attack/
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error when handling .swf files. A remote attacker can create a specially crafted SWF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was reported by Anton Ivanovn of Kaspersky.
Used by ScarCruft hacking team in Operation Daybreak and Operation Erebus as suggested by Kaspersky Lab.
It has been used in targeted attacks carried out by a new ScarCruft APT group operating primarily against high-profile victims in China, South Korea, India, Russia, Nepal, Romania, and Kuwait.
Software: Adobe Flash Player
Links:
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
https://securelist.com/blog/research/75082/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attac...
http://securityaffairs.co/wordpress/48400/hacking/cve-2016-4171-flash-0-day.html
http://www.securityweek.com/flash-zero-day-exploited-targeted-attacks
https://community.norton.com/en/blogs/security-covered-norton/critical-adobe-flash-player-vulnerabil...
https://threatpost.com/scarcruft-apt-group-used-latest-flash-zero-day-in-two-dozen-attacks/118642/
http://zerosecurity.org/2016/06/flash-zero-day-cve-2016-4171
http://neurogadget.net/2016/06/21/hackers-exploiting-critical-adobe-flash-player-vulnerability/33701
https://www.scmagazine.com/adobe-patches-critical-zero-day-vulnerability-in-flash-player/article/529...
http://activecypher.com/cve-2016-4171-another-flash-zero-day-exploited-in-targeted-attacks/
https://nakedsecurity.sophos.com/2016/06/15/critical-flash-vulnerability-is-being-exploited-in-the-w...
https://www.beyondtrust.com/blog/critical-zero-day-vulnerability-cve-2016-4171-basic-mitigation/
https://arstechnica.com/security/2016/06/critical-adobe-flash-bug-under-active-attack-currently-has-...
http://wccftech.com/flash-zero-day-vulnerability-exploited-in-the-wild/
http://www.digitaltrends.com/computing/adobe-exploit-scarcruft/
http://www.theinquirer.net/inquirer/news/2461612/new-threat-uses-flash-zero-day-to-attack-big-busine...
http://thecharlestendellshow.com/scarcruft-apt-group-exploited-flash-zero-day-in-high-profile-attack...
https://www.intego.com/mac-security-blog/adobe-flash-alert-0-day-exploit-for-vulnerability-in-the-wi...
http://www.bankinfosecurity.com/adobe-flings-flash-fix-for-fresh-apt-target-a-9207
Arbitrary file upload
The vulnerability allows a remote attacker to upload arbitrary files to compromise the target system.Researchers at Sucuri said that attacks against WordPress sites running the plugin started on May 26.
Software: WP Mobile detector
Links:
https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-d...
https://threatpost.com/wordpress-patches-zero-day-in-wp-mobile-detector-plugin/118458/ https://www.recoverwp.com/en/arbitrary-file-upload-vulnerability-in-wp-mobile-detector/
https://blog.sucuri.net/2016/06/wp-mobile-detector-vulnerability-being-exploited-in-the-wild.html
http://news.softpedia.com/news/wordpress-sites-under-attack-from-new-zero-day-in-wp-mobile-detector-...
https://vulners.com/threatpost/WORDPRESS-PATCHES-ZERO-DAY-IN-WP-MOBILE-DETECTOR-PLUGIN/118458
http://www.spamfighter.com/News-20313-WordPress-Websites-Being-Assaulted-Through-Fresh-0-Day-within-...
http://www.builditdigital.com/blog/wp-mobile-detector-plugin-makes-over-10-000-wordpress-sites-vulne...
http://www.zdnet.com/article/over-10000-wordpress-sites-vulnerable-to-exploit/
Improper input validation
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a logic error when parsing IPv6 Neighbor Discovery (ND) packets, sent directly to the device. A remote attacker can send specially crafted IPv6 traffic to the affected device and cause the device to stop processing IPv6 traffic.
Successful exploitation of the vulnerability will result in denial of service attack.
Note: according to Cisco, this vulnerability is being exploited in the wild.
Software: Cisco IOS XR
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Used to target South Korean organizations.
A banking (Duuzer back door) trojan distributed by Sundown Exploit Kit (EK) to target South Korean organizations. Later it was included into Magnitude and KaiXin EKs.
Software: Microsoft Internet Explorer
Known/fameous malware:
Exploit kit: Magnitude, Neutrino, RIG, Sundown.
Links:
http://theori.io/research/cve-2016-0189
https://github.com/theori-io/cve-2016-0189
https://technet.microsoft.com/library/security/MS16-053
https://technet.microsoft.com/library/security/ms16-051
https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0189
http://malware.dontneedcoffee.com/2016/07/cve-2016-0189-internet-explorer-and.html
https://www.symantec.com/security_response/writeup.jsp?docid=2016-061306-3604-99
https://www.symantec.com/connect/blogs/internet-explorer-zero-day-exploit-used-targeted-attacks-sout...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=70147
http://malware.dontneedcoffee.com/2016/07/cve-2016-0189-internet-explorer-and.html
http://blog.trendmicro.com/trendlabs-security-intelligence/may-2016-patch-tuesday-fixes-browser-scri...
https://www.fireeye.com/blog/threat-research/2016/07/exploit_kits_quickly.html
https://www.virusbulletin.com/blog/2017/01/paper-journey-and-evolution-god-mode-2016-cve-2016-0189/
http://www.securityweek.com/microsoft-patches-flaws-exploited-targeted-attacks
http://sensorstechforum.com/may-2016-patch-tuesday-cve-2016-0189-kb3155533-kb3156764/
http://securityaffairs.co/wordpress/54093/intelligence/cnacom-campaign.html
https://www.zscaler.com/blogs/research/cnacom-open-source-exploitation-strategic-web-compromise
http://forensicblogs.com/tag/cve-2016-0189/
https://threatpost.com/patched-ie-zero-day-incorporated-into-neutrino-ek/119321/
http://securityaffairs.co/wordpress/49383/cyber-crime/neutrino-ek-ie-flaw.html
http://www.securityweek.com/ie-exploit-added-neutrino-after-experts-publish-poc
http://www.cybersecurity-review.com/internet-explorer-zero-day-exploit-used-in-targeted-attacks-in-s...
http://www.zdnet.com/article/south-korea-victim-of-internet-explorer-zero-day-vulnerability/
http://thecharlestendellshow.com/experts-published-ie-exploit-code-and-crooks-added-it-to-neutrino-e...
https://cybernewsgroup.co.uk/ie-exploit-added-to-neutrino-after-experts-publish-poc/
http://www.networkworld.com/article/3068505/microsoft-fixes-actively-attacked-ie-flaw-and-50-other-v...
https://www.scmagazine.com/patch-tuesday-microsoft-rolls-out-16-bulletins-eight-rated-critical/artic...
http://news.redpiranha.net/Landing-Page-Containing-CVE-2016-0189-Exploit-Code-Used-to-Target-Taiwane...
http://www.darkreading.com/attacks-breaches/windows-0-day-exploit-used-in-recent-wave-of-pos-attacks...
https://securityintelligence.com/news/proof-of-compromise-new-neutrino-exploit-runs-on-research/
https://www.grahamcluley.com/neutrino-exploit-kit-adds-zero-day-flaw-arsenal/
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to type confusion error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution.The vulnerability was reported by Genwei Jiang.
The zero-day was used by the Pawn Storm and APT3 cyber espionage groups in Operation Erebus campaign and seen in payloads included with CryptXXX, Cerber and DMA Locker ransomware, as well as the Gootkit Trojan.
Software: Adobe Flash Player
Known/fameous malware:
Exploit kit: Angler, Magnitude, Neutrino, RIG.
Links:
https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html
https://helpx.adobe.com/security/products/flash-player/apsa16-02.html
https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
http://securityaffairs.co/wordpress/47197/hacking/cve-2016-4117-adobe-flash-zero.html
https://security.berkeley.edu/news/vulnerable-adobe-flash-player-allows-remote-code-execution-cve-20...
http://news.softpedia.com/news/nine-days-later-flash-zero-day-cve-2016-4117-already-added-to-exploit...
https://www.helpnetsecurity.com/2016/05/16/flash-0day-exploit-booby-trapped-office-file/
http://securityaffairs.co/wordpress/47379/cyber-crime/cve-2016-4117-exploit-chain.html
https://andreafortuna.org/cve-2016-4117-a-new-adobe-flash-0-day-in-the-wild-56e78d519bf5#.9ogjnryxb
http://www.pcworld.com/article/3073561/security/a-recently-patched-flash-player-exploit-is-being-use...
https://www.peerlyst.com/posts/cve-2016-4117-fireeye-revealed-the-exploit-chain-of-recent-attacks-he...
https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-8-adds-support-for-flash-v...
http://neurogadget.net/2016/05/29/adobe-flash-player-exploit-used-hackers-attack-users/31733
http://www.bankinfosecurity.com/zero-day-attacks-pummel-ie-flash-a-9093
Input validation error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Code execution vulnerability in ImageMagick was found by Nikolay Ermishkin from Mail.Ru Security Team while researching original report.
Security researcher Behrouz Sadeghipour discovered that the vulnerability was present in the web domain belonging to Polyvore.
The vulnerabilily is dubbed "ImageTragick".
Software: ImageMagick
Links:
https://imagetragick.com/
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.440568
http://blog.trendmicro.com/trendlabs-security-intelligence/imagemagick-vulnerability-allows-remote-c...
http://www.darknet.org.uk/2016/05/multiple-serious-imagemagick-zero-day-vulnerabilities/
http://www.zdnet.com/article/yahoos-polyvore-vulnerable-to-imagemagick-flaw-researcher-receives-litt...
http://www.securityweek.com/yahoo-rewards-researcher-imagemagick-hack
http://sec.sangfor.com.cn:88/vulns/290.html
https://www.helpnetsecurity.com/2016/05/04/imagemagick-zero-day-flaw/
http://www.sangfor.com/source/blog-network-security/696.html
https://arstechnica.com/security/2016/05/exploits-gone-wild-hackers-target-critical-image-processing...
http://www.nickhammond.com/fixing-imagemagick-cve-20163714-with-ansible/
http://www.securityweek.com/attackers-exploit-critical-imagemagick-vulnerability
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to improper handling of objects in memory by the kernel-mode driver. A local attacker can run a specially crafted program, gain elevated privileges and execute arbitrary code with SYSTEM privileges.
Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Used to compromise organizations in the USA and Canada. First attacks were detected in 08.03.2016.
Software: Windows
Known/fameous malware:
PUNCHBABY or PUNCHTRACK Trojan.
Links:
https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Exploit:Win64/CVE-2016...
https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html
https://technet.microsoft.com/library/security/ms16-039 http://www.securitytracker.com/id/1035532
http://blog.trendmicro.com/tippingpoint-threat-intelligence-zero-day-coverage-week-april-11-2016/
http://blog.cybersheath.com/adobe-and-windows-zero-day-exploits-in-the-wild
https://threatpost.com/microsoft-zero-day-exposes-100-companies-to-pos-attack/118026/
https://arstechnica.com/security/2016/05/beware-of-in-the-wild-0day-attacks-exploiting-windows-and-f...
http://sensorstechforum.com/windows-zero-day-exploited-to-steal-credit-card-data-from-us-companies/
http://www.securityweek.com/windows-zero-day-leveraged-financial-attacks
http://www.zdnet.com/article/microsoft-windows-zero-day-exposes-companies-to-crippling-cyberattacks/
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to improper handling of objects in memory by the kernel-mode driver. A local attacker can run a specially crafted program, gain elevated privileges and execute arbitrary code with SYSTEM privileges.
Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The Badlock vulnerability.
Software: Windows
Links:
https://technet.microsoft.com/en-us/library/security/ms16-039.aspx
https://threatpost.com/fruityarmor-apt-group-used-recently-patched-windows-zero-day/121398/
http://www.networkworld.com/article/3054645/security/microsoft-rated-6-of-13-security-updates-as-cri...
https://securelist.com/blog/research/76396/windows-zero-day-exploit-used-in-targeted-attacks-by-frui...
http://www.infoworld.com/article/3055572/security/dont-let-badlock-distract-you-from-real-vulnerabil...
http://news.softpedia.com/news/microsoft-releases-critical-windows-edge-browser-office-security-upda...
https://www.infosecurity-magazine.com/news/patch-tuesday-badlock-bulletin/
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to type confusion error when handling .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution.The weakness was presented by Kafeine (EmergingThreats/Proofpoint), Genwei Jiang (FireEye, Inc.) and Clement Lecigne (Google).
According to FireEye, on April 2, Kafeine provided details on a version of the Magnitude Exploit Kit that was originally believed to be exploiting known Adobe Flash vulnerabilities.
Software: Adobe Flash Player
Known/fameous malware:
Magnitude, Neutrino and Nuclear Pack Exploit Kit.
Cerber and DMA Locker ransomware.
Links:
https://helpx.adobe.com/security/products/flash-player/apsa16-01.html
https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html
http://blog.trendmicro.com/trendlabs-security-intelligence/look-adobe-flash-player-cve-2016-1019-zer...
https://www.proofpoint.com/us/threat-insight/post/killing-zero-day-in-the-egg
http://securityaffairs.co/wordpress/46107/malware/adobe-fixes-cve-2016-1019.html
https://www.bleepingcomputer.com/news/security/adobe-releases-security-advisory-on-critical-vulnerab...
http://www.zdnet.com/article/cyberattackers-botch-integration-of-adobe-flash-zero-day-vulnerability-...
http://www.eweek.com/security/adobe-patches-zero-day-flaw-used-by-exploit-kit.html
https://www.grahamcluley.com/adobe-flash-responsible-six-top-10-bugs-used-exploit-kits-2016/
http://hub-apac.insight.com/h/i/236881036-zero-day-attack-discovered-in-magnitude-exploit-kit-target...
https://trushieldinc.com/adobe-flash-player-zero-day-exploit/
https://blog.malwarebytes.com/threat-analysis/exploits-threat-analysis/2016/04/botched-flash-0day-ge...
http://www.symantec.com/connect/blogs/new-flash-zero-day-exploited-attackers-wild
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2016-1019-zero-day-integrated-in-expl...
https://threatpost.com/emergency-update-coming-for-flash-vulnerability-under-attack/117219/
http://www.ecommercetimes.com/story/83348.html
Integer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to integer overflow. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution.The vulnerability was reported by Anton Ivanov from Kaspersky Lab. The vulnerability was used by the ScarCruft group in Operation Daybreak campaign.
Software: Adobe Flash Player
Known/fameous malware:
Used in Angler Exploit Kit.
Links:
https://helpx.adobe.com/security/products/flash-player/apsb16-08.html
http://blog.trendmicro.com/trendlabs-security-intelligence/root-cause-analysis-recent-flash-zero-day...
http://blog.trendmicro.com/trendlabs-security-intelligence/adobe-issues-emergency-patch-flash-zero-d...
ttp://blog.trendmicro.com/trendlabs-security-intelligence/tag/cve-2016-1010/
https://security.berkeley.edu/news/adobe-flash-player-multiple-zero-day-vulnerabilities-cve-2016-101...
https://technet.microsoft.com/en-us/library/security/MS16-036
http://securityaffairs.co/wordpress/45226/breaking-news/adobe-emergency-out-of-band-update.html
https://news.ycombinator.com/item?id=11262403
https://www.slashgear.com/adobe-flash-player-update-fixes-critical-vulnerabilities-11431218/
https://securify.co.in/adobe-flash-player/zero-day-adobe-flash-player-vulnerability-cve-2016-1010-2/
https://arstechnica.com/security/2016/03/adobe-issues-emergency-patch-for-actively-exploited-code-ex...
https://nakedsecurity.sophos.com/2016/03/11/flash-zero-day-prompts-emergency-update-from-adobe/
https://www.scmagazine.com/adobe-patches-active-flash-player-flaw/article/528925/
https://hotforsecurity.bitdefender.com/blog/update-flash-now-targeted-attacks-exploiting-security-ho...
http://www.securityweek.com/adobe-patches-flash-zero-day-under-attack
http://www.spamfighter.com/News-20163-Security-Bug-Used-in-Live-Attacks-is-Fixed-by-Releasing-Adobe-...
http://www.pcworld.com/article/3043055/security/emergency-flash-player-patch-fixes-actively-exploite...
http://wccftech.com/adobe-patches-yet-another-critical-flash-exploit/
https://www.infosecurity-magazine.com/news/adobe-issues-patch-for-23-flash/
http://www.eweek.com/blogs/security-watch/adobe-updates-flash-to-patch-zero-day-flaw.html
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a use-after-free error when processing malicious .swf content. A remote attacker can create a specially crafted .SWF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability may result in complete compromise of vulnerable system.
According to Kasperksy Lab report, this vulnerability has bein actively exploited in the wild by BlackOasis APT actor.
According to Kaspersky Lab, this vulnerability has being exploited in the wild by BlackOasis actor in June 2015.
Software: Adobe Flash Player
Use-after-free error
The vulnerability allows a local attacker to gain elevated privileges on the target system.The critical Linux kernel flaw (CVE-2016-0728) has been identified by a group of researchers at a startup named Perception Point.
The vulnerability has existed since 2012, but was disclosed in January, 2016.
Software: Linux kernel
Links:
http://thehackernews.com/2016/01/linux-kernel-hacker.html
http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-...
https://www.cyberciti.biz/faq/linux-cve-2016-0728-0-day-local-privilege-escalation-vulnerability-fix...
http://williamdurand.fr/2016/01/21/patching-linux-kernel-raspbian/
http://securityaffairs.co/wordpress/43758/hacking/linux-kernel-vulnerability-fixed.html
http://www.pcworld.com/article/3023870/security/linux-kernel-flaw-endangers-millions-of-pcs-servers-...
https://syslint.com/blog/tutorial/new-linux-kernel-zero-day-exploit-vulnerability-cve-2016-0728/
https://l3net.wordpress.com/2016/01/20/firejail-target-practice-cve-2016-0728/
https://threatpost.com/serious-linux-kernel-vulnerability-patched/115923/
http://www.securityweek.com/linux-kernel-flaw-puts-millions-devices-risk
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.On July 5, 2015, a large amount of data from one company was leaked to the Internet with a hacker known as тАЬPhineas FisherтАЭ claiming responsibility for the breach.
Software: Microsoft Silverlight
Known/fameous malware:
Used in Angler, Hunter, RIG and Sundown Exploit Kit.
Links:
https://technet.microsoft.com/en-us/library/security/MS16-006
https://securelist.com/blog/research/73255/the-mysterious-case-of-cve-2016-0034-the-hunt-for-a-micro...
https://www.symantec.com/security_response/writeup.jsp?docid=2016-011507-1032-99
http://blog.trendmicro.com/trendlabs-security-intelligence/malvertising-campaign-in-us-leads-to-angl...
http://www.broadanalysis.com/2016/03/21/silverlight-exploit-leads-to-teslacrypt-cve-2016-0034/
http://sensorstechforum.com/attack-involves-silverlight-exploit-cve-2016-0034-angler-ek-and-teslacry...
http://www.securityweek.com/hacking-team-leak-leads-discovery-silverlight-zero-day
http://www.securityweek.com/exploit-recently-patched-silverlight-flaw-added-angler
https://www.trustwave.com/Resources/SpiderLabs-Blog/Sundown-EK-%E2%80%93-Stealing-Its-Way-to-the-Top...
http://securityaffairs.co/wordpress/44774/cyber-crime/angler-ek-silverlight-exploit.html
https://blog.qualys.com/securitylabs/2016/01/14/hunting-for-vulnerable-functions-in-microsoft-silver...
http://www.zdnet.com/article/microsoft-silverlight-exploit-spotted-in-angler-kit/
http://www.zdnet.com/article/kaspersky-lab-discovers-silverlight-zero-day-vulnerability/
http://news.softpedia.com/news/hackers-wasted-their-time-adding-a-silverlight-exploit-to-the-angler-...
https://www.scmagazine.com/as-kaspersky-labs-researchers-predicted-exploits-of-silverlight-vulnerabi...
http://blog.morphisec.com/javascript-in-ie-overtakes-flash-as-number-one-target-for-angler-exploit-k...
https://threatpost.com/new-silverlight-attacks-appear-in-angler-exploit-kit/116409/
https://arstechnica.com/security/2016/02/malicious-websites-exploit-silverlight-bug-that-can-pwn-mac...
http://www.darkreading.com/vulnerabilities---threats/kaspersky-caught-scent-of-silverlight-zero-day-...
Integer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to integer overflow. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Software: Adobe Flash Player
Known/fameous malware:
Exploit kits: Angler, Neutrino, Nuclear Pack and RIG
Links:
https://helpx.adobe.com/security/products/flash-player/apsb16-01.html
https://blogs.forcepoint.com/security-labs/popular-site-leads-angler-ek-cve-2015-8651-flash-player-e...
https://www.symantec.com/security_response/writeup.jsp?docid=2015-122818-3536-99&tabid=2
https://blogs.forcepoint.com/security-labs/popular-site-leads-angler-ek-cve-2015-8651-flash-player-e...
https://krebsonsecurity.com/tag/cve-2015-8651/
https://blogs.technet.microsoft.com/mmpc/2016/06/20/reverse-engineering-dubniums-flash-targeting-exp...
https://krebsonsecurity.com/tag/cve-2015-8651/
https://www.scmagazine.com/adobe-issues-critical-flash-player-patch/article/533434/
http://vulnerablespace.blogspot.com/2016/06/malware-analysing-and-repurposing-rigs.html
https://blog.qualys.com/laws-of-vulnerabilities/2015/12/28/last-adobe-0-day-patched-for-the-year
https://www.reddit.com/r/ReverseEngineering/comments/43a1i5/an_analysis_on_the_principle_of_cve20158...
http://www.securityweek.com/adobe-issues-emergency-patch-flash-zero-day-under-attack
http://securityaffairs.co/wordpress/43131/cyber-crime/adobe-flash-zero-day.html
http://securityaffairs.co/wordpress/54120/reports/exploit-kits-top-flaws.html
https://blog.malwarebytes.com/threat-analysis/exploits-threat-analysis/2016/07/a-look-into-some-rig-...
http://www.darkreading.com/vulnerabilities---threats/here-are-4-vulnerabilities-ransomware-attacks-a...
https://www.recordedfuture.com/recent-ransomware-vulnerabilities/
http://resources.infosecinstitute.com/most-exploited-vulnerabilities-by-whom-when-and-how/#gref
http://neurogadget.net/2016/12/08/adobe-flash-player-bugs-issues-exploits-computers/48666
http://thehackernews.com/2015/12/adobe-flash-security-update.html
http://www.theregister.co.uk/2015/12/28/adobe_flash_security_update/
https://www.solutionary.com/resource-center/blog/2015/12/adobe-flash-player-vulnerability/
http://wccftech.com/flash-player-receives-emergency-security-patch/
http://news.softpedia.com/news/adobe-fixes-flash-zero-day-bug-discovered-by-huawei-498184.shtml
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.Revealed during source code review by the vendor.
Software: Juniper ScreenOS
Links:
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST
https://blog.cryptographyengineering.com/2015/12/22/on-juniper-backdoor/
http://securityaffairs.co/wordpress/42983/hacking/juniper-backdoor-attacks-honeypot.html
https://adamcaudill.com/2015/12/17/much-ado-about-juniper/
http://www.dmnews.com/news-bytes/juniper-warns-of-two-attacks-of-unauthorised-code-on-its-routers/ar...
http://resources.infosecinstitute.com/infosec-year-end-highlights/#gref
https://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-n...
https://thehackernews2.blogspot.com/2016/12/backdoor-found-in-sonys-ip-security.html
http://blogs.splunk.com/2016/01/05/discover-and-monitor-juniper-vulnerability-cve-2015-7755-exploits...
http://www.securityweek.com/juniper-firewall-backdoor-password-found-6-hours
http://www.theregister.co.uk/2015/12/20/juniper_details_two_attacks_from_unauthorised_code/
Authentication bypass
The vulnerability allows a remote attacker to bypass authentication on the target system.Revealed during source code review by the vendor.
Software: Juniper ScreenOS
Links:
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST
https://blog.cryptographyengineering.com/2015/12/22/on-juniper-backdoor/
http://securityaffairs.co/wordpress/42983/hacking/juniper-backdoor-attacks-honeypot.html
https://adamcaudill.com/2015/12/17/much-ado-about-juniper/
http://www.dmnews.com/news-bytes/juniper-warns-of-two-attacks-of-unauthorised-code-on-its-routers/ar...
http://resources.infosecinstitute.com/infosec-year-end-highlights/#gref
https://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-n...
https://thehackernews2.blogspot.com/2016/12/backdoor-found-in-sonys-ip-security.html
http://blogs.splunk.com/2016/01/05/discover-and-monitor-juniper-vulnerability-cve-2015-7755-exploits...
http://www.securityweek.com/juniper-firewall-backdoor-password-found-6-hours
http://www.theregister.co.uk/2015/12/20/juniper_details_two_attacks_from_unauthorised_code/
Remote PHP code execution
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to insufficient filtration of HTTP User-Agent header and filter-search HTTP POST parameter before storing them into database. A remote unauthenticated attacker can permanently inject and execute arbitrary PHP code on the target system with privileges of the web server.
Successful exploitation of this vulnerability will allow a remote attacker to gain complete control over the vulnerable web application and execute arbitrary PHP code on the target system.
Note: this is a zero-day vulnerability and it is being exploited in the wild.
The vulnerability was used to compromise vulnerable websites for 16000 (sometimes - 20000) times per day.
Software: Joomla!
Links:
https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.h...
https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-0-Day-Exploited-In-the-Wild-(CVE-2015-856...
https://www.masergy.com/blog/joomla-remote-code-execution-vulnerability-cve-2015-8562
http://securityaffairs.co/wordpress/43108/cyber-crime/cve-2015-8562-joomla-flaw.html
https://www.liquidweb.com/kb/protecting-joomla-sites-against-cve-2015-8562/
https://security.berkeley.edu/news/joomla-core-150-345-remote-code-execution-cve-2015-8562
http://www.webhostingtalk.com/showthread.php?t=1536679
http://jaitsec.blogspot.com/2015/12/testing-joomla-for-cve-2015-8562.html
http://www.securityweek.com/vulnerable-joomla-servers-see-16000-daily-attacks
http://blogs.quickheal.com/joomla-exploit-cve-2015-8562-still-at-large/
http://news.softpedia.com/news/latest-joomla-vulnerability-targeted-by-attackers-16-600-times-per-da...
Memory corruption
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to boundary error when handling of objects in kernel memory. A local attacker can execute a specially crafted program, trigger memory corruption and gain SYSTEM privileges.
Successful exploitation of this vulnerability results in privilege escalation on the vulnerable system.
Note: the vulnerability was being actively exploited.
Software: Windows
Links:
https://www2.trustwave.com/rs/815-RFM-693/images/2016%20Trustwave%20Global%20Security%20Report.pdf
https://technet.microsoft.com/library/security/ms15-135
https://www.symantec.com/security_response/vulnerability.jsp?bid=78514
http://www.securityweek.com/microsoft-patches-windows-office-flaws-exploited-wild
Security bypass
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to unknown error related to the Java SE Deployment component. A remote attacker can bypass the click-to-play protection in Java.
Successful exploitation of the vulnerability results in security bypass on the vulnerable system.
Note: the vulnerability was being actively exploited.
Exploited by the Fancy Bear APT.
This was quite useful in Pawn Storm, as it used exploits targeting these vulnerabilities to carry out targeted attacks against North Atlantic Treaty Organization (NATO) members and the White House earlier this year.
Software: Java SE
Links:
http://blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-how-the-pawn-storm-zero-day...
https://blog.qualys.com/laws-of-vulnerabilities/2015/10/21/oracle-critical-patch-update-october-2015
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html http://resources.infosecinstitute.com/the-shadow-of-the-russian-cyber-army-behind-the-2016-president...
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to type confusion error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Was used in Pawn Storm Campaign Targeting Foreign Affairs Ministries. Exploited by the Fancy Bear APT.
The vulnerability was reported by Peter Pi of Trend Micro.
Software: Adobe Flash Player
Known/fameous malware:
Exploit Kits: Angler, Hunter, Magnitude, Neutrino, Nuclear Pack, RIG, Spartan.
Links:
https://helpx.adobe.com/security/products/flash-player/apsa15-05.html
https://helpx.adobe.com/security/products/flash-player/apsb15-27.html
http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-sto...
http://resources.infosecinstitute.com/the-shadow-of-the-russian-cyber-army-behind-the-2016-president...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=28924
https://www.symantec.com/security_response/writeup.jsp?docid=2015-101903-5534-99
https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=869
http://www.theregister.co.uk/2016/12/08/need_xmas_ideas_try_cve20157645_a_flash_gift_that_keeps_on_g...
http://www.securityweek.com/adobe-patches-flash-zero-day-exploited-pawn-storm
http://vulnerablespace.blogspot.com/2016/04/malware-analysing-and-repurposing.html
https://blog.malwarebytes.com/threat-analysis/2015/10/new-flash-player-zero-day-in-the-wild/
https://arstechnica.com/security/2015/10/new-zero-day-exploit-hits-fully-patched-adobe-flash/
http://securityaffairs.co/wordpress/41123/cyber-crime/flash-zero-day-exploit.html
http://www.infoworld.com/article/3046531/security/ransomware-targets-flash-and-silverlight-vulnerabi...
https://www.tripwire.com/state-of-security/latest-security-news/flash-player-zero-day-patched-by-ado...
http://www.welivesecurity.com/2015/10/15/adobe-flash-zero-day/
https://threatpost.com/emergency-adobe-flash-zero-day-patch-arrives-ahead-of-schedule/115073/
http://thehackernews.com/2015/10/flash-patch-update.html
https://www.scmagazine.com/adobe-addresses-latest-flash-player-zero-day-vulnerability/article/533522...
Arbitrary code execution
The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper handling of Media Center link (.mcl) files. A remote attacker can create a specially crafted Media Center link (.mcl) file that references malicious code, trick the victim into opening it and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability results in system compromise.Note: the vulnerability was being actively exploited.
This vulnerability is related to a previously unreported zero-day exploit discovered in the Hacking Team leaked emails. Trend Micro researchers (Aaron Luo, Kenney Lu, and Ziv Chang) discovered the exploit and subsequently reported their findings to Microsoft.
Software: Windows Media Center
Links:
https://www2.trustwave.com/rs/815-RFM-693/images/2016%20Trustwave%20Global%20Security%20Report.pdf
http://blog.trendmicro.com/trendlabs-security-intelligence/windows-media-center-hacking-team-bug-fix...
https://technet.microsoft.com/library/security/ms15-100
http://www.cio.com/article/2982358/microsoft-patches-yet-another-hacking-team-zero-day-exploit.html
http://blog.trendmicro.com/trendlabs-security-intelligence/windows-media-center-hacking-team-bug-fix...
http://resources.infosecinstitute.com/exploiting-ms15-100-cve-2015-2509/#gref
http://www.csoonline.com/article/2982487/vulnerabilities/microsoft-patches-yet-another-hacking-team-...
http://securityaffairs.co/wordpress/40019/hacking/windows-media-center-ht-bug.html
https://vulners.com/metasploit/MSF:EXPLOIT/WINDOWS/FILEFORMAT/MS15_100_MCL_EXE
https://www.symantec.com/security_response/vulnerability.jsp?bid=76594
http://www.pcworld.com/article/2982361/microsoft-patches-yet-another-hacking-team-zero-day-exploit.h...
Memory corruption
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists due to boundary error in ATMFD.dll in Win32k.sys. A local attacker can execute a specially crafted program, trigger memory corruption and gain SYSTEM privileges.
Successful exploitation of the vulnerability may result in full control of the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was reported by FireEye researcher Wang Yu.
Software: Windows
Links:
https://technet.microsoft.com/en-us/library/security/ms15-097
https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf
https://www.symantec.com/security_response/vulnerability.jsp?bid=76608
https://krebsonsecurity.com/2015/09/microsoft-pushes-a-dozen-security-updates/
http://www.securityweek.com/microsoft-patches-windows-vulnerability-exploited-wild
https://www.scmagazine.com/microsoft-fixes-several-bugs-on-patch-tuesday-two-being-actively-exploite...
https://www.helpnetsecurity.com/2015/09/09/microsoft-pushes-out-security-updates-plugs-holes-activel...
https://threatpost.com/microsoft-patches-graphics-component-flaw-under-attack/114575/
http://www.securitynewspaper.com/2015/09/09/microsoft-patches-graphics-component-flaw-under-attack/
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when parsing malformed images. A remote attacker can create a file containing a specially crafted image file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
CVE-2015-2545 fuels around 17% of attacks in Microsoft Office.
Used to target organisations in China.
Software: Microsoft Office
Links:
https://technet.microsoft.com/en-us/library/security/ms15-099
https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf
http://pwc.blogs.com/cyber_security_updates/2016/05/exploring-cve-2015-2545-and-its-users.html
https://threatpost.com/apt-groups-finding-success-with-patched-microsoft-flaw/118298/
http://www.securityweek.com/year-old-office-vulnerabilities-most-popular-current-attacks
https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/
https://www.symantec.com/security_response/vulnerability.jsp?bid=76667
https://blogs.sophos.com/2016/07/18/cybercriminals-shift-their-tactics-for-microsoft-office-document...
https://www.threatconnect.com/blog/word-document-trojan-exploiting-cve/
http://www.itworldcanada.com/article/exploit-kits-now-adopting-recent-office-vulnerabilities-report/...
https://www.scmagazine.com/microsoft-fixes-several-bugs-on-patch-tuesday-two-being-actively-exploite...
http://blog.morphisec.com/exploit-bypass-emet-cve-2015-2545
http://news.softpedia.com/news/one-microsoft-office-exploit-has-become-very-popular-with-cyber-espio...
http://news.softpedia.com/news/ke3chang-is-back-and-it-s-targeting-indian-embassies-around-the-globe...
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to type confusion error. A remote attacker can create a specially crafted HWPX file containing a set of directories and XML files, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.
Note: this vulnerability is being actively exploited.
Trojan.Volgmer.B. Attackers from North Korea exploited the vulnerability HANGMAN in a word processor popular with the South Korea's government to steal the documents and upload them to a C&C server.
North Korea attack in June dubbed "Macktruck".
Software: Hancom Office
Links:
https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/FireEye_HWP_ZeroDay.p...
https://www.fireeye.com/blog/threat-research/2015/09/zero-day_hwp_exploit.html
http://www.pcworld.com/article/2982577/north-korea-is-likely-behind-attacks-exploiting-a-korean-word...
http://www.hancom.com/index.jsp
http://securityaffairs.co/wordpress/40029/hacking/north-kore-0-day-hangul.html
https://c0deman.wordpress.com/2015/11/02/hangul-word-processor-hwp-zero-day-possible-ties-to-north-k...
http://www.securityweek.com/north-korea-suspected-using-zero-day-attack-south
http://www.theregister.co.uk/2015/09/10/north_korea_exploits_zero_day_in_seouls_favourite_word_doc/
http://www.spamfighter.com/News-19851-North-Korea-Probably-Main-Architect-of-Cyberattacks-in-South-K...
http://www.ehackingnews.com/2015/09/researchers-say-north-korea-behind.html
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error when handling Javascript and HTML tables within the layout cache. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability has been exploited in watering hole attacks against compromised website belonging to an evangelical church in Hong Kong to deliver Korplug malware.
Software: Microsoft Internet Explorer
Known/fameous malware:
Korplug malware.
Links:
https://technet.microsoft.com/library/security/MS15-093
http://www.securityweek.com/microsoft-issues-emergency-patch-critical-ie-flaw-exploited-wild
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=28195
https://www.alienvault.com/blogs/security-essentials/internet-explorer-memory-corruption-vulnerabili...
https://www.tripwire.com/state-of-security/vulnerability-management/ie-under-attack-microsoft-releas...
https://krebsonsecurity.com/2015/08/microsoft-pushes-emergency-patch-for-ie/
https://www.redpacketsecurity.com/cve-2015-2502-microsoft-issues-emergency-patch-for-all-versions-of...
https://blog.qualys.com/laws-of-vulnerabilities/2015/08/18/ms15-093--oob-fix-for-internet-explorer
https://arstechnica.com/security/2015/08/microsoft-issues-emergency-patch-for-critical-ie-bug-under-...
https://www.scmagazine.com/microsoft-patches-critical-remote-code-execution-bug-in-internet-explorer...
https://www.symantec.com/connect/tr/blogs/new-internet-explorer-zero-day-exploited-hong-kong-attacks
https://malwarelist.net/tag/zero-day-vulnerability/
http://www.darkreading.com/attacks-breaches/ie-bug-exploited-in-wild-after-microsoft-releases-out-of...
http://thehackernews.com/2015/08/microsoft-emergency-patch-zero-day-internet-explorer.html
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
The vulnerability was discovered by Yong Chuan, Koh of MWR Labs.
Software: Microsoft Office
Links:
https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
https://www.symantec.com/security_response/vulnerability.jsp?bid=76200
https://www.nccgroup.trust/uk/our-research/understanding-microsoft-word-ole-exploit-primitives/
https://labs.mwrinfosecurity.com/advisories/microsoft-office-ctasksymbol-use-after-free-vulnerabilit...
http://blog.trendmicro.com/trendlabs-security-intelligence/august-patch-tuesday-includes-update-for-....
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to improper processing of symbolic links by Mount Manager. By inserting a specially crafted USB device into the system, an attacker can create arbitrary files and execute malicious code with SYSTEM privileges.
Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Attackers used USB to infect computers with the malware at the Natanz uranium enrichment facility in Iran.
The .LNK vulnerability was also exploited by the Equation Group, uncovered by researchers at Kaspersky Lab.
Software: Windows
Known/fameous malware:
Fanny
Links:
https://technet.microsoft.com/en-us/library/security/ms15-085.aspx https://blogs.technet.microsoft.com/srd/2015/08/11/defending-against-cve-2015-1769-a-logical-issue-e...
https://cdn4.esetstatic.com/eset/US/resources/docs/white-papers/Windows_Exploitation_in_2015.pdf
https://threatpost.com/microsoft-patches-usb-related-flaw-used-in-targeted-attacks/114240/
https://threats.kaspersky.com/en/vulnerability/KLA10646/
https://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000786.aspx
http://www.securityweek.com/microsoft-adobe-patch-dozens-security-vulnerabilities
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to buffer overflow in Windows Adobe Type Manager library when processing OpenType fonts. A remote attacker can create a specially crafted document or website with embedded malicious OpenType font, trick the victim into opening it, cause memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: the vulnerability was being actively exploited.
The exploit code was revealed after Hacking Team data leak.
The vulnerability was reported by FireEye's Genwei Jiang and Google Project Zero's Mateusz Jurczyk.
The vulnerability has being exploited by Eugene Ching of Qavar Security on the January 2015.
Software: Windows
Links:
Remote code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to unknown error in Libraries component. A remote attacker can execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability may result in full control of the vulnerable system.
Note: the vulnerability was being actively exploited.
The attacks were launched by a cyberespionage group known as Pawn Storm or APT28 targeting the White House and members of the North Atlantic Treaty Organization (NATO) back in April 2015.
The group has been active since 2007 and typically targets military, government and media organizations.
Software: Java SE
Links:
http://www.trendmicro.com/vinfo/us/threat-encyclopedia/vulnerability/7033/oracle-java-se-remote-code...
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.pcworld.com/article/2948592/security/oracle-fixes-zeroday-java-flaw-and-over-190-other-vu...
http://www.computerworld.com/article/2947216/security/cyberespionage-group-pawn-storm-uses-exploit-f...
http://resources.infosecinstitute.com/the-shadow-of-the-russian-cyber-army-behind-the-2016-president...
https://www.tripwire.com/state-of-security/latest-security-news/java-zero-day-bug-192-other-security...
http://www.securityweek.com/oracle-patches-java-zero-day-exploited-pawn-storm-attackers
http://blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-how-the-pawn-storm-zero-day...
https://duo.com/blog/update-flash-and-java-emergency-zero-day-patches
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error. A remote attacker can create a specially crafted Web-site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The exploit code was revealed after Hacking Team data leak.
Software: Microsoft Internet Explorer
Links:
тАЬUse-after-freeтАЭ error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error in the ActionScript 3 BitmapData class. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The exploit code was revealed after Hacking Team data leak.
Software: Adobe Flash Player
Known/fameous malware:
SWF_EKSPLOYT.EDF. (TrendMicro).
Links:
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html
https://www.symantec.com/connect/blogs/third-adobe-flash-zero-day-exploit-cve-2015-5123-leaked-hacki...
http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-...
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html
http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-...
http://securityaffairs.co/wordpress/38574/cyber-crime/hacking-team-cve-2015-5123.html
https://www.tripwire.com/state-of-security/vulnerability-management/another-zero-day-flash-exploit-r...
https://www.scmagazine.com/researchers-report-flash-player-zero-day-bugs-after-hacking-team-leaks/ar...
http://www.securityweek.com/two-new-flash-player-zero-day-bugs-found-hacking-team-leak
https://threatpost.com/flash-player-update-patches-two-hacking-team-zero-days/113776/ https://www.zscaler.com/blogs/research/hacking-team-leak-flash-0day-exploit-payloads-and-more
http://www.zdnet.com/article/adobe-promises-patch-for-latest-wave-of-critical-hacking-team-zero-day-...
http://securityaffairs.co/wordpress/38518/cyber-crime/hacking-team-new-0zero.html
тАЬUse-after-freeтАЭ error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error in the ActionScript 3 opaqueBackground class. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The exploit code was revealed after Hacking Team data leak. The exploit was used against Japanese organizations.
The vulnerability was reported by Dhanesh Kizhakkinan of FireEye as well as Peter Pi of TrendMicro.
Software: Adobe Flash Player
Known/fameous malware:
Exploit kits: Angler EK - 2015-07-11 Neutrino - 2015-07-13 Nuclear Pack - 2015-07-14 RIG - 2015-07-14 Magnitude - 2015-07-15 NullHole - 2015-07-22 Spartan - 2015-09-11
Links:
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=28060
http://blog.trendmicro.com/trendlabs-security-intelligence/another-zero-day-vulnerability-arises-fro...
Memory corruption
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists due to boundary error in the Adobe Type Manager module (ATMFD.dll). A local attacker can execute a specially crafted application, trigger memory corruption, bypass OS-level sandboxing and execute arbitrary code with SYSTEM privileges.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.The exploit code was revealed after Hacking Team data leak.
Public exploit code for this vulnerability became available as part of the Hacking Team leaks on July 5, 2015.
Software: Windows
Links:
https://technet.microsoft.com/en-us/library/security/ms15-077.aspx http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vuln...
http://www.securityweek.com/microsoft-patches-hacking-team-zero-days-other-vulnerabilities
https://countuponsecurity.com/2015/07/24/hacking-team-arsenal-of-cyber-weapons/
https://securingtomorrow.mcafee.com/business/security-connected/microsoft-patch-tuesday-july-2015/
http://www.bankinfosecurity.com/hacking-team-dump-windows-zero-day-a-8404
https://www.secureworks.com/blog/targeted-exploit-and-escalation
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web-site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The exploit code was revealed after Hacking Team data leak. Was also used in phishing campaigns conducted by two Chinese advanced persistent threat (APT) groups: APT3 and APT18.
The vulnerability was reported by Google Project Zero and Morgan Marquis-Boire.
Software: Adobe Flash Player
Links:
https://helpx.adobe.com/security/products/flash-player/apsb15-16.html
https://helpx.adobe.com/security/products/flash-player/apsa15-03.html
http://securityaffairs.co/wordpress/38707/cyber-crime/phishing-cve-2015-5119.html
https://www.zscaler.com/blogs/research/adobe-flash-vulnerability-cve-2015-5119-analysis
https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html
http://www.bankinfosecurity.com/zero-day-exploit-alert-flash-java-a-8396
https://www.zscaler.com/blogs/research/adobe-flash-vulnerability-cve-2015-5119-analysis
https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Flash-Exploit-(CVE-2015-5119)-From-the-Hacking...
http://null-byte.wonderhowto.com/how-to/hack-like-pro-use-hacking-teams-adobe-flash-exploit-0163051/
http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-flash-zero-day-integrated-in...
https://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-teams-flash-zero-day/#more-31458
https://blog.malwarebytes.com/threat-analysis/2015/07/hacking-team-leak-exposes-new-flash-zero-day/
https://www.scmagazine.com/adobe-fixes-flash-player-zero-day-bug-identified-in-hacking-team-leak/art...
Heap-based buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow when processing Office files. A remote attacker can create a specially crafted Office file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of this vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability reffers to the APT28 and Operation Pawn Storm and was used in cyber espionage campaign by Tsar Team.
Software: Microsoft Office
Known/fameous malware:
Trojan.Win32.Sofacy.
Links:
https://technet.microsoft.com/en-us/library/security/ms15-070.aspx
http://resources.infosecinstitute.com/the-shadow-of-the-russian-cyber-army-behind-the-2016-president...
https://www.trustwave.com/Resources/SpiderLabs-Blog/Tsar-Team-Microsoft-Office-Zero-Day-CVE-2015-242...
https://www.symantec.com/security_response/vulnerability.jsp?bid=75744
http://www.securityweek.com/microsoft-patches-office-zero-day-bug-used-apt-group
Heap-based buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to heap-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Exploited by a China-based cyberespionage group. Operation Clandestine Wolf тАУ Adobe Flash Zero-Day in APT3 Phishing Campaign.
Software: Adobe Flash Player
Known/fameous malware:
Magnitude exploit kit.
Links:
https://helpx.adobe.com/security/products/flash-player/apsb15-14.html
https://hitmanpro.wordpress.com/2015/07/02/how-apt3-evaded-anti-exploits-with-cve-2015-3113/
https://nakedsecurity.sophos.com/2015/06/29/latest-flash-hole-already-exploited-ransomware/
http://securityaffairs.co/wordpress/38044/cyber-crime/adobe-fixed-cve-2015-3113.html
http://www.securityweek.com/adobe-flash-player-zero-day-exploited-attack-campaign
http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-zero-day-shares-same-root-cause...
http://www.computerweekly.com/news/4500248673/Adobe-patches-Flash-Player-vulnerability-CVE-2015-3113
http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days...
https://arstechnica.com/security/2015/06/patch-early-patch-often-adobe-pushes-emergency-fix-for-acti...
http://www.pcworld.com/article/2939552/adobe-patches-zeroday-flash-player-flaw-used-in-targeted-atta...
http://www.techtimes.com/articles/63254/20150624/adobe-releases-patch-to-plug-flash-players-zero-day...
https://www.recordedfuture.com/use-cases/vulnerability-identification/
http://www.theregister.co.uk/2015/06/29/ransomware_exploit_kit_slinger_exploits_flash_remote_code_ex...
http://www.computerworlduk.com/security/cybercriminals-pounce-on-serious-flash-zero-day-flaw-3618019..
Memory corruption
The vulnerability allows a local attacker to obtain elevated privileges on the target system.Expoited by Duqu 2.0 and used in attack against the Kaspersky Lab to hack their internal networks in early spring 2015.
Software: Windows
Links:
https://technet.microsoft.com/en-us/library/security/ms15-061.aspx
https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-ac...
http://securityaffairs.co/wordpress/37714/cyber-crime/duqu-2-0-hit-kaspersky.html
http://blog.trendmicro.com/trendlabs-security-intelligence/analysis-of-cve-2015-2360-duqu-2-0-zero-d...
https://www.symantec.com/security_response/vulnerability.jsp?bid=75025
http://blog.ensilo.com/ms-patch-tuesday-a-look-into-4-vulnerabilities-in-the-windows-kernel
https://www.virusbulletin.com/conference/vb2015/abstracts/duqu-2-0-win32k-exploit-analysis/
http://usa.kaspersky.com/about-us/press-center/press-releases/2015/duqu-back-kaspersky-lab-reveals-c..
https://blogs.bromium.com/2015/06/16/duqu-2-0-whos-the-lord-of-ring0/
Arbitrary PHP code execution
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.Software: Mt-phpincgi
Privilege escalation
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists due to improper access control. A local attacker can create a specially crafted application, execute a callback in userspace and use data from the System token to execute arbitrary code on the system with root privileges.
Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.The vulnerability was combined with CVE-2015-3043 to perform Operation "Russian Doll".
Exploited by RussiaтАЩs APT28 (Fancy Bear APT) in cyber espionage campaign on the U.S defense contractors, European security companies and Eastern European government entities.
Software: Windows
Links:
https://technet.microsoft.com/en-us/library/security/ms15-051
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html http://resources.infosecinstitute.com/the-shadow-of-the-russian-cyber-army-behind-the-2016-president...
http://blog.trendmicro.com/trendlabs-security-intelligence/exploring-cve-2015-1701-a-win32k-elevatio...
https://www.symantec.com/security_response/vulnerability.jsp?bid=74245
https://www.reddit.com/r/microsoft/comments/334zyo/russia_use_unpatched_cve20151701_in/
https://thehacktimes.com/cyber-espionage-operation-russian-doll/
http://www.eweek.com/security/russian-based-attackers-use-two-zero-days-in-one-attack.html
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error when handling rich text format files. A remote attacker can create a specially crafted RTF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability accounts for nearly 66% of attacks using Office Word.
APT attacks, targeting Tibetans, Uyghurs, human rights groups in Taiwan and Hong Kong, and journalists.
Software: Microsoft Office
Links:
https://technet.microsoft.com/en-us/library/security/ms15-033.aspx
http://www.securityweek.com/year-old-office-vulnerabilities-most-popular-current-attacks
https://degsew.wordpress.com/2016/03/28/new-microst-office-word-2007-2013-exploit-cve-2015-1641-anal...
http://news.softpedia.com/news/cve-2015-1641-and-cve-2015-2545-are-today-s-most-popular-microsoft-wo...
http://www.securityweek.com/spear-phishing-attacks-target-industrial-firms-kaspersky-lab-ics-cert
http://www.securitynewspaper.com/2016/07/19/cve-2015-1641-cve-2015-2545-todays-popular-microsoft-wor...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Attackers exploited the vulnerabilities together to attack a government entity to and steal politically sensitive data that is a known target of the Russian group (APT campaign).
Software: Adobe Flash Player
Links:
https://helpx.adobe.com/security/products/flash-player/apsb15-06.html http://resources.infosecinstitute.com/the-shadow-of-the-russian-cyber-army-behind-the-2016-president...
https://krebsonsecurity.com/2015/04/critical-updates-for-windows-flash-java/#more-30672
http://www.securityweek.com/russia-linked-hackers-used-two-zero-days-recent-targeted-attack-fireeye
http://www.zdnet.com/article/russian-hackers-exploit-flash-windows-flaws-to-spy-on-diplomat-targets/
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
http://www.eweek.com/security/russian-based-attackers-use-two-zero-days-in-one-attack.html
http://securityaffairs.co/wordpress/36105/cyber-crime/apt28-russian-hackers.html
https://www.advancedbusinesssolutions.com/blog/curated-content/russian-hackers-use-flash-windows-zer...
https://www.infosecurity-magazine.com/news/apt28-back-russiandoll-attack/
Insecure dll. library loading
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the way Microsoft Windows parses shortcuts. A remote attacker can place a specially crafted .dll file along with an icon file on a remote SMB or WebDav share, trick the victim into opening that document and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability was being actively exploited.
According to Trustwave it is a zero-day.
Vulnerability CVE-2015-0096 is a continuation of CVE-2010-2568, which was believed to have been patched by MS10-046. However, it was not completely and we see this with MS15-018. At the time of the patch release there were fully functional exploits for this particular vulnerability.
Software: Windows
Security bypass
The vulnerabiity allows a remote attacker to bypass security restrictions on the target system.Allegedly, Chinese hackers combined it with a remote-code execution vulnerability in Adobe Flash to infect visitors to the Forbes website with malware since November, 2014.
Software: Microsoft Internet Explorer
Known/fameous malware:
JS:CVE-2015-0071-A.
Links:
https://technet.microsoft.com/library/security/ms15-009
https://cdn4.esetstatic.com/eset/US/resources/docs/white-papers/Windows_Exploitation_in_2015.pdf
https://www.symantec.com/security_response/vulnerability.jsp?bid=72455
http://blog.trendmicro.com/trendlabs-security-intelligence/bypassing-aslr-with-cve-2015-0071-an-out-...
https://www.invincea.com/2015/02/chinese-espionage-campaign-compromises-forbes/
http://www.theregister.co.uk/2015/02/10/patch_tuesday_release_fixes_unprecedented_zeroday_design_fla...
https://www.hackread.com/hackers-use-flash-and-ie-to-target-forbes-visitors/
https://arstechnica.com/security/2015/02/pwned-in-7-seconds-hackers-use-flash-and-ie-to-target-forbe...
http://www.securityweek.com/microsoft-patches-critical-windows-internet-explorer-vulnerabilities-pat...
http://www.threatgeek.com/2016/05/turbo-twist-two-64-bit-derusbi-strains-converge.html
https://www.scmagazine.com/forbescom-attackers-exploited-zero-days-in-flash-ie/article/536348/
https://arstechnica.com/security/2015/02/pwned-in-7-seconds-hackers-use-flash-and-ie-to-target-forbe...
Stored cross-site scripting
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-input. A remote attacker can send a specially crafted HTTP request to vulnerable website and permanently store arbitrary HTML and JavaScript code on it. The code will be executed in browser of every website visitor.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Note: the vulnerability was being actively exploited.
The vulnerability was notified by Konstantin Kovshenin and Gennady Kovshenin.
Software: FancyBox
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error when processing .swf content. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was used during malwertising campaign against visitors of dailymotion.com.
Software: Adobe Flash Player
Known/fameous malware:
SWF_EXPLOIT.MJST
Hanjuan Exploit Kit
Links:
https://helpx.adobe.com/security/products/flash-player/apsa15-02.html
https://helpx.adobe.com/security/products/flash-player/apsb15-04.html
http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zer...
http://www.securityweek.com/adobe-prepares-patch-another-critical-flash-player-vulnerability
https://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/#more-29724
http://www.greatsoftline.com/another-critical-zero-day-vulnerability-in-adobe-flash-player/
https://nakedsecurity.sophos.com/2015/02/03/news-flash-3rd-time-newunlucky-0-day-hits-adobes-browser...
https://www.recordedfuture.com/top-vulnerabilities-2015/
http://www.networkworld.com/article/3003176/security/8-of-top-10-vulnerabilities-used-by-exploit-kit...
http://www.itnews.com.au/news/hackers-target-third-new-zero-day-for-adobe-flash-399960
http://researchcenter.paloaltonetworks.com/2015/02/palo-alto-networks-traps-protects-enterprises-zer...
http://www.fin24.com/Tech/News/Hackers-target-Adobe-Flash-again-20150205
https://arstechnica.com/security/2015/02/as-flash-0day-exploits-reach-new-level-of-meanness-what-are...
http://www.techtimes.com/articles/30925/20150206/adobe-releases-patch-for-dangerous-flash-player-zer...
http://www.darkreading.com/new-adobe-flash-0-day-used-in-malvertising-campaign/d/d-id/1318900
https://philipcao.com/2015/02/04/palo-alto-networks-traps-protects-enterprises-from-zero-day-cve-201...
https://betanews.com/2015/02/02/surprise-adobe-flash-has-a-security-flaw-on-windows-mac-and-linux/
Cross-site scripting
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.CVE-2015-0072 was apparently reported to Microsoft on Oct. 13, 2014, however David Leo disclosed the details of this vulnerability to the popular Full Disclosure security mailing list on Jan. 31, 2015.
Software: Microsoft Internet Explorer
Known/fameous malware:
Exploit: HTML/CVE-2015-0072.A
Links:
https://technet.microsoft.com/library/security/ms15-018
http://www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-at...
https://nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bu...
https://blogs.forcepoint.com/security-labs/another-day-another-zero-day-%E2%80%93-internet-explorers...
http://22by7.helpserve.com/News/NewsItem/View/5773/another-day-another-zero-day--internet-explorers-...
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was discovered by French security researcher тАЬKafeineтАЭ.
It was actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. It was used by Angler EK and infected at least 1,800 known domains.
Software: Adobe Flash Player
Known/fameous malware:
SWF/Exploit.CVE-2015-0311.N(2)
Trojan.Swifi (Symantec)
Angler EK
Links:
https://helpx.adobe.com/security/products/flash-player/apsb15-03.html
http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear...
http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0311-flash-zero-day-vu...
http://researchcenter.paloaltonetworks.com/2015/01/unpatched-flash-vulnerability-cve-2015-0311-block...
http://securityaffairs.co/wordpress/32687/security/adobe-fix-cve-2015-0311-0day.html
http://www.kamnet.com/adobe-flash-player-vulnerability-cve-2015-0311/
http://www.criticalwatch.com/faqs/zero-day-vulnerability-in-adobe-flash/
http://www.free-remove-spyware.com/post/Cannot-Remove-SWFExploit.CVE-2015-0311.N2-SWFExploit.CVE-201...
http://www.securityweek.com/adobe-fixes-second-flash-player-zero-day-vulnerability
http://www.pcworld.com/article/2878792/flash-player-plagued-by-third-zeroday-flaw-in-a-month-updates...
Security bypass
The vulnerability allows a remote attacker to circumvent memory address randomization on the target system.
The weakness exists due to memory leak error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption, bypass memory address randomization on the Windows platform and obtain sensitive information.
Note: the vulnerability was being actively exploited.
The vulnerability was discovered and reported by security researcher Kafeine.
The vulnerability was used in attacks against older versions of Flash Player.
Software: Adobe Flash Player
Known/fameous malware:
Angler EK.
Links:
https://helpx.adobe.com/security/products/flash-player/apsb15-02.html
https://ae.norton.com/security_response/writeup.jsp?docid=2015-021009-2659-99
https://www.beyondtrust.com/blog/adobe-patches-zero-day-flaw-being-exploited-in-the-wild/
https://www.intego.com/mac-security-blog/flash-player-0day-vulnerability-jolts-rushed-update/
http://www.pcworld.com/article/2874172/adobe-fixes-just-one-of-two-actively-exploited-zeroday-vulner...
http://www.eweek.com/security/new-zero-day-exploit-adds-to-adobe-flash-security-woes.html
Path traversal
The vulnerability allows a remote attacker to gain elevated privileges on the target system.
The weakness exists due to insufficient validation of user-supplied input within TS WebProxy Windows component. A remote attacker can trick the victim into downloading a specially crafted file and execute it with privileges of the current user.
Successful exploitation of the vulnerability may result in full control of the vulnerable system.
Note: the vulnerability was being actively exploited.
The vulnerability was being used in CNACOM campaign targeting government organization in Taiwan.
Software: Windows
Known/fameous malware:
Exploit.Win32.CVE-2015-0016.
Links:
https://technet.microsoft.com/library/security/ms15-004
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explo...
https://www.symantec.com/security_response/vulnerability.jsp?bid=71965
http://www.securityweek.com/china-linked-spies-target-taiwan-ie-exploit
http://securityaffairs.co/wordpress/33153/cyber-crime/fessleak-malvertising-campaign.html
http://securityaffairs.co/wordpress/54093/intelligence/cnacom-campaign.html
Stack-based buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was discovered by the researcher тАШbilouтАЩ, who reported the bug through HPтАЩs Zero Day Initiative (ZDI).
Has been used in a watering hole attack against US Defense and Financial Services firms, where it was hosted on the compromised Forbes.com website.
Software: Adobe Flash Player
Known/fameous malware:
Trojan.Win32.Bergard.A.
Links:
https://helpx.adobe.com/security/products/flash-player/apsb14-27.html
https://www.symantec.com/security_response/writeup.jsp?docid=2015-011509-4745-99
http://www.securityweek.com/adobe-patches-flash-player-vulnerability-exploited-wild
http://news.softpedia.com/news/Chinese-Hackers-Target-Forbes-com-In-Watering-Hole-Attack-472871.shtm...
http://www.cso.com.au/article/562228/adobe-patches-flash-zero-day-under-attack/
http://blog.malcovery.com/forbes.com-adobe-flash-player-and-your-email
http://securityaffairs.co/wordpress/33417/cyber-crime/chinese-hackers-hit-forbes.html
https://arstechnica.com/security/2015/02/pwned-in-7-seconds-hackers-use-flash-and-ie-to-target-forbe...
Improper input validation
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to improper input validation when processing packets sent to the WinCC server. A remote unauthenticated attacker can send a specially crafted packet and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability has been exploited in targeted attacks.
The vulnerability has been exploited in targeted attacks involving BlackEnergy Trojan.
Software: Siemens SIMATIC WinCC
Known/fameous malware:
BlackEnergy
Privilege escalation
The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.Exploited by Duqu.
The vulnerability was reported by Qualcomm Information Security & Risk Management team.
Software: Windows
Links:
https://technet.microsoft.com/library/security/MS14-068
https://blogs.technet.microsoft.com/srd/2014/11/18/additional-information-about-cve-2014-6324/
http://securityaffairs.co/wordpress/30320/security/microsoft-patch-kerberos-bug.html
https://www.symantec.com/security_response/vulnerability.jsp?bid=70958
https://www.netiq.com/communities/cool-solutions/detecting-windows-kerberos-implementation-elevation...
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.According TrendMicro and Symantec this is a zero-day.
Backdoors Emdivi, Korplug and ZXshell were used in the cyberespionage campaign,тАЬOperation CloudyOmega,тАЭ to target Japanese organisations.
Software: Ichitaro
Known/fameous malware:
Emdivi
Korplug
ZXshell
Links:
http://www.justsystems.com/jp/info/js14003.html
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/reports/rpt-magnified-losses-a...
https://www.symantec.com/connect/tr/blogs/operation-cloudyomega-ichitaro-zero-day-and-ongoing-cybere...
https://malwerewolf.com/2014/11/cool-news-story-bro-week-11-21-2014/
Privilege escalation
The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.CVE-2014-4077 used in targeted attack in the wild to bypass Adobe Reader Sandbox via binary hijacking using malicious DIC file.
Software: Windows
Code injection
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Microsoft first received information about this vulnerability through coordinated vulnerability disclosure. Zero-day was initially found and reported to McAfee by James Forshaw of Google Project Zero.
The vulnerability is publicly known as "Sandworm" and has been exploited by the Chinese against Taiwan.
Software: Windows
Known/fameous malware:
Trojan.Mdropper. (Symantec).
Links:
https://technet.microsoft.com/en-us/library/security/ms14-064
http://blog.trendmicro.com/trendlabs-security-intelligence/microsoft-windows-hit-by-new-zero-day-att...
https://malwarelist.net/2014/10/22/cve-2014-6352-critical-vulnerability-in-microsoft-windows/
https://www.symantec.com/connect/blogs/attackers-circumvent-patch-windows-sandworm-vulnerability
http://www.theregister.co.uk/2014/10/22/powerpoint_attacks_exploit_ms_0day/
http://www.computerworld.com/article/2837084/microsoft-misses-windows-bug-hackers-slip-past-patch.ht...
https://nakedsecurity.sophos.com/2014/10/24/has-the-sandworm-exploit-burrowed-back/
http://www.eweek.com/security/microsoft-patches-33-vulnerabilities-in-november-patch-tuesday-update....
https://techtalk.gfi.com/the-lesson-of-sandworm-patched-but-not-protected/
Privilege escalation
The vulnerability allows a remote attacker to obtain elevated privileges on the target system.CrowdStrike first detected the attacks in spring.
The zero-day reported by CrowdStrike was also reported by FireEye.
The issue has been introduced in 07/27/2005.
The vulnerability was handled as a non-public zero-day exploit for at least 3366 days.
Exploited by Hurricane Panda.
Software: Microsoft Internet Explorer
Links:
https://blogs.technet.microsoft.com/srd/2014/10/14/assessing-risk-for-the-october-2014-security-upda...
https://technet.microsoft.com/library/security/ms14-056
https://blog.qualys.com/laws-of-vulnerabilities/2014/10/14/october-2014-patch-tuesday
https://www.symantec.com/security_response/vulnerability.jsp?bid=70326
http://www.darkreading.com/attacks-breaches/hurricane-panda-cyberspies-used-windows-zero-day-for-mon...
https://computerobz.wordpress.com/2014/10/22/october-2014-patch-tuesday-addresses-four-active-zero-d...
Information disclosure
The vulnerability allows a remote attacker to perform MitM attack.The vulnerability was used in the attack called Poodle against Docker.
Software: OpenSSL
Links:
https://www.openssl.org/~bodo/ssl-poodle.pdf
https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/reports/rpt-magnified-losses-a...
https://www.appsecconsulting.com/blog/zero-day-attacks-in-2014
https://technet.microsoft.com/en-us/library/security/3009008.aspx
https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc
https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html
http://www.oracle.com/technetwork/java/javase/documentation/cve-2014-3566-2342133.html
https://www.tripwire.com/state-of-security/vulnerability-management/ssl-v3-poodle-vulnerability-reve...
https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
https://www.entrust.com/get-support/ssl-certificate-support/poodle-security-vulnerability/
https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/poodle-sslv3-vulnerability-t...
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.An Adobe Flash vulnerability was discovered in October and promptly patched. The exploits in the Nuclear and Angler kits were detected by the French researcher Kafeine shortly after the company released an update on Oct.14. Despite a patch on 14, October 2014, the vulnerability was not completely mitigated. The vulnerability was patched again in November, 25.
Software: Adobe Flash Player
Known/fameous malware:
Troj/SWFExp-CD.
Exploit kits: Angler, Nuclear, and Astrum.
Links:
https://helpx.adobe.com/security/products/flash-player/apsb14-22.html
https://helpx.adobe.com/security/products/flash-player/apsb14-26.html
https://blogs.technet.microsoft.com/mmpc/2014/12/02/an-interesting-case-of-the-cve-2014-8439-exploit...
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2014-8439-vulnerability-trend-micro-s...
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2014-8439-vulnerability-trend-micro-s...
https://www.fireeye.com/blog/threat-research/2015/01/a_different_exploit.html
https://nakedsecurity.sophos.com/2014/11/28/adobe-publishes-out-of-band-flash-update-booster-dose-fo...
http://www.pcworld.com/article/2852412/adobe-tries-again-to-fix-flash-vulnerability.html
http://www.techtimes.com/articles/20976/20141126/adobe-releases-patch-to-re-fix-flash-player-vulnera...
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was highly exploited by advanced adversary group named HURRICANE PANDA.
Software: Windows
Links:
https://www.fireeye.com/blog/threat-research/2014/10/two-targeted-attacks-two-new-zero-days.html
https://technet.microsoft.com/en-us/library/security/ms14-058.aspx
http://security.stackexchange.com/questions/92164/the-way-vulnerabilities-like-cve-2014-4148-are-dis...
https://www.scmagazine.com/zero-day-attackers-exploit-windows-kernel-patch-tuesday-brings-fix/articl...
http://www.securityweek.com/multiple-patch-tuesday-vulnerabilities-under-attack
http://www.capitalcomputercentre.com/best-way-to-remove-s3traypd-exeexp-cve-2014-4148-exp-cve-2014-4...
Improper input validation
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The zero-day vulnerability is being claimed to have been used in early September in possible campaigns against NATO, Ukrainian government
organizations, Western European government organization, Energy Sector firms (specifically in Poland), European telecommunications firms, United States academic organizations.
Files in the SandWorm exploit hilighted by iSIGHT Partners include a malicious executable from a known malware family, namely the BlackEnergy Trojan.
Software: Windows
Known/fameous malware:
Dyreza Trojan.
SandWorm
BlackEnergy Trojan.
Links:
https://technet.microsoft.com/en-us/library/security/ms14-060
http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerabi...
https://citizenlab.org/2015/06/targeted-attacks-against-tibetan-and-hong-kong-groups-exploiting-cve-...
http://security.stackexchange.com/questions/70894/windows-ole-vulnerability-cve-2014-4114-sandworm
http://thehackernews.com/2014/10/microsoft-windows-zero-day_13.html
https://www.cyphort.com/cve-2014-4114-sandworm-worm/
https://www.symantec.com/security_response/writeup.jsp?docid=2014-102322-3150-99
https://www.symantec.com/connect/blogs/sandworm-windows-zero-day-vulnerability-being-actively-exploi...
https://threatpost.com/dyreza-banker-trojan-attackers-exploiting-cve-2014-4114-windows-flaw/109071/
Privilege escalation
The vulnerability allows a local attacker to obtain elevated privileges on the target system.The vulnerability was apparently found and reported to Microsoft by both ╨бrowdStrike and FireEye.
The vulnerability has been actively exploited in the wild for at least five month by highly advanced adversary group named HURRICANE PANDA.
Software: Windows
Known/fameous malware:
Nuclear Exploit Kit.
Links:
https://technet.microsoft.com/en-us/library/security/ms14-058
https://dl.packetstormsecurity.net/papers/attack/CVE-2014-4113.pdf
https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-expl...
https://www.fireeye.com/blog/threat-research/2014/10/two-targeted-attacks-two-new-zero-days.html
http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vuln...
http://securityaffairs.co/wordpress/29270/security/microsoft-fixes-3-zero-day.html
http://www.securityweek.com/multiple-patch-tuesday-vulnerabilities-under-attack
https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-lab-exploiting-cve-2014-4113.pdf
Code injection
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to an error in the legacy FreePBX ARI Framework module/Asterisk Recording Interface (ARI). A remote attacker can bypass the authentication process and execute arbitrary code with administrative privileges.
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: this vulnerability was being actively exploited.
Software: FreePBX
Command injection
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to incorrect parsing of environment variables. A remote attacker can execute arbitrary code on the target system as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
Successful exploitation may allow an attacker to gain complete control over vulnerable system.
Exploitation example:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
Note: this vulnerability was being actively exploited in the wild.
Shellshock is a variety of vulnerabilities in GNU Bash implementation caused by incomplete patches after official release of the fix and public disclosure of the vulnerability. There were 5 failed attempts in total to fix this Shellshock bugs until it was finally patched in version bash43-027, released on October 1, 2014.
Some of these vulnerabilities were exploited in the wild before the patch, which makes them zero-days. These vulnerabilities are covered under the following CVEs:
CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187
Giving the nature of the vulnerabilities and attack vectors we have decided to cover these vulnerabilities under one description and count them as one zero-day vulnerability.
Software: Bash
Shellshock is a variety of vulnerabilities in GNU Bash implementation caused by incomplete patches after official release of the fix and public disclosure of the vulnerability. There were 5 failed attempts in total to fix this Shellshock bugs until it was finally patched in version bash43-027, released on October 1, 2014.
Some of these vulnerabilities were exploited in the wild before the patch, which makes them zero-days. These vulnerabilities are covered under the following CVEs:
CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187
Giving the nature of the vulnerabilities and attack vectors we have decided to cover these vulnerabilities under one description and count them as one zero-day vulnerability.
Links:
http://lcamtuf.blogspot.cz/2014/09/quick-notes-about-bash-bug-its-impact.html
http://unix.stackexchange.com/questions/157381/when-was-the-shellshock-cve-2014-6271-7169-bug-introd...
http://askubuntu.com/questions/528101/what-is-the-cve-2014-6271-bash-vulnerability-shellshock-and-ho...
http://www.trendmicro.com/vinfo/us/threat-encyclopedia/vulnerability/6033/bash-vulnerability-shellsh...
https://www.tripwire.com/state-of-security/off-topic/shell-shocked-bash-bug-detection-tools-cve-2014...
http://security.stackexchange.com/questions/100388/avast-performing-an-attack
http://community.ispyconnect.com/ispybb2/viewtopic.php?t=1360
https://securelist.com/blog/research/66673/bash-cve-2014-6271-vulnerability-qa-2/
http://resources.infosecinstitute.com/bash-bug-cve-2014-6271-critical-vulnerability-scaring-internet...
https://www.symantec.com/connect/blogs/shellshock-all-you-need-know-about-bash-bug-vulnerability
https://www.alienvault.com/blogs/labs-research/attackers-exploiting-shell-shock-cve-2014-6271-in-the...
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.PoC-code for this vulnerability was available since at least April 25, 2013.
Software: Microsoft Internet Explorer
Known/fameous malware:
Exploit kits: Angler, Rig, Nuclear, Styx.
Links:
https://technet.microsoft.com/en-us/library/security/ms14-052.aspx
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=70103
http://www.securityweek.com/microsoft-patches-internet-explorer-vulnerability-targeted-attackers
http://www.pcworld.com/article/2604688/internet-explorer-steals-the-patch-tuesday-spotlight-again.ht...
http://www.csoonline.com/article/2607297/data-protection/microsoft-patch-fixed-ie-flaw-used-against-...
https://securelist.com/blog/software/66474/microsoft-updates-september-2014-apt-loses-a-trick-remini...
https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-evolution-of-...
https://labs.bromium.com/2014/09/16/pirates-of-the-internetz-the-curse-of-the-waterhole/
https://www.scmagazine.com/watering-hole-attack-targets-website-visitors-of-oil-and-gas-start-up/art...
http://www.scmagazineuk.com/rsa-2016-fingerprinting-the-latest-twist-used-for-malvertising-attacks/a...
Privelege escalation
The vulnerability allows a remote attacker to obtain elevated privileges on the target system.Software: Microsoft Internet Explorer
Security bypass
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was discovered by Costin Raiu and Vitaly Kamluk of Kaspersky Labs.
Exploited by Animal Farm group.
Software: Adobe Reader
Links:
https://helpx.adobe.com/security/products/reader/apsb14-19.html
https://www.symantec.com/security_response/vulnerability.jsp?bid=69193
https://www.symantec.com/security_response/writeup.jsp?docid=2014-082218-1438-99
http://securityaffairs.co/wordpress/27535/cyber-crime/cve-2014-0546-adobe-flaw.html
http://zerosecurity.org/2014/08/cve-2014-0546-found-utilized-small-targeted-attacks
http://www.securityweek.com/adobe-patches-security-flaw-leveraged-targeted-attacks
https://heatsoftware.com/blog/9286/urgent-adobe-users-told-to-patch-reader-and-acrobat-against-zero-...
http://www.burningflameinteractive.com/aj-burning-flame-blog/adobe-patches-zero-day-vulnerability
Security bypass
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The issue has been introduced in 01/30/2007.
Software: Microsoft Office
Privilege escalation
The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.Software: Windows
Links:
https://technet.microsoft.com/en-us/library/security/ms14-025
https://dirteam.com/sander/2014/05/23/security-thoughts-passwords-in-group-policy-preferences-cve-20...
https://www.tripwire.com/state-of-security/vulnerability-management/vert-alert-may-2014-microsoft-pa...
https://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000604.aspx
тАЬUse-after-freeтАЭ error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.CVE-2014-1815 was reported to Microsoft by Clement Lecigne, a security engineer who works for Google in its Swiss office.
The vulnerability was used in the phishing campaign started on or about July 21, 2014 and primarily targeting the energy industry.
Software: Microsoft Internet Explorer
Links:
https://technet.microsoft.com/en-us/library/security/ms14-029
https://www.symantec.com/security_response/writeup.jsp?docid=2014-051503-4437-99
https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=721
http://researchcenter.paloaltonetworks.com/2014/07/beginning-end-use-free-exploitation/
http://blog.trendmicro.com/trendlabs-security-intelligence/may-2014-patch-tuesday-rolls-out-8-bullet...
http://www.securityweek.com/microsoft-adobe-patch-critical-security-vulnerabilities
Privilege escalation
The vulnerability allows a local attacker to obtain elevated privileges on the target system.Software: Windows
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.A sample of the first exploit was detected on April 14, while a sample of the second came on April 16. The first exploit was initially recorded by KSN on April 9, when it was detected by a generic heuristic signature.
The disclosed vulnerability was actively exploited and relates to attack via the website of Syrian Ministry of Justice in September, 2013.
Software: Adobe Flash Player
Known/fameous malware:
Exploit:SWF/CVE-2014-0515
Links:
https://helpx.adobe.com/security/products/flash-player/apsb14-13.html
https://securelist.com/blog/incidents/59399/new-flash-player-0-day-cve-2014-0515-used-in-watering-ho...
http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2014-0515-the-recent-flash-...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27555
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27552
https://www.zscaler.com/blogs/research/nuclear-exploit-kit-and-flash-cve-2014-0515
http://54.204.81.18/news/stories/39397-blog-new-flash-player-0-day-cve-2014-0515-used-in-watering-ho...
http://www.securityweek.com/adobe-patches-flash-player-zero-day-used-watering-hole-attacks
https://krebsonsecurity.com/2014/04/adobe-update-nixes-flash-player-zero-day/#more-25786
тАЬUse-after-freeтАЭ error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability uses a heap-spray technique. Used in Pawn Storm campaign.
Used by APT groups.
Software: Microsoft Internet Explorer
Links:
https://technet.microsoft.com/en-US/library/security/2963983
https://technet.microsoft.com/en-us/library/security/ms14-021.aspx
https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explore...
https://blog.fortinet.com/2014/05/27/a-technical-analysis-of-cve-2014-1776
https://www.symantec.com/connect/blogs/emerging-threat-microsoft-internet-explorer-zero-day-cve-2014...
https://support.norton.com/sp/en/us/home/current/solutions/v98738922_EndUserProfile_en_us
https://www.trustwave.com/Resources/SpiderLabs-Blog/Microsoft-Internet-Explorer-0-Day-(CVE-2014-1776...
https://www.cyphort.com/dig-deeper-ie-vulnerability-cve-2014-1776-exploit/
http://researchcenter.paloaltonetworks.com/2014/05/tale-3-vulnerabilities-cve-2014-1776-exploit-link...
http://blog.trendmicro.com/trendlabs-security-intelligence/internet-explorer-zero-day-hits-all-versi...
https://www.beyondtrust.com/blog/internet-explorer-0day-cve-2014-1776/
http://thehackernews.com/2014/04/new-zero-day-vulnerability-cve-2014.html
https://krebsonsecurity.com/tag/cve-2014-1776/
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Used in Pawn Storm campaign, attacks against government agencies in Taiwan.
Software: Microsoft Office
Known/fameous malware:
Trojans like Dridex or Dyreza and ransomware like cryptolocker or Teslacrypt.
Links:
https://technet.microsoft.com/en-us/library/security/2953095.aspx
https://technet.microsoft.com/en-us/library/security/ms14-017
https://securingtomorrow.mcafee.com/mcafee-labs/close-look-rtf-zero-day-attack-cve-2014-1761-shows-s...
https://community.hpe.com/t5/Security-Research/Technical-Analysis-of-CVE-2014-1761-RTF-Vulnerability...
https://www.trustwave.com/Resources/SpiderLabs-Blog/Microsoft-Word-RTF-0-Day-(CVE-2014-1761)/
http://stopmalvertising.com/malware-reports/a-closer-look-at-cve-2014-1761.html
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2014/june/extracting-the-payload-fr...
https://blog.cylance.com/infinity-vs-the-real-world-ms-word-vulnerability-cve-2014-1761
https://myonlinesecurity.co.uk/reswift-copy-word-doc-malware-cve-2014-1761-exploit/
https://www.symantec.com/connect/blogs/emerging-threat-microsoft-word-zero-day-cve-2014-1761-remote-...
https://avstrike.wordpress.com/2015/05/05/exploit-cve-2014-1761-gen-removal-guide-2/
http://www.securityweek.com/new-microsoft-word-zero-day-used-targeted-attacks
https://blog.yoocare.com/remove-exploit-cve-2014-1761-gen/
https://www.crowdstrike.com/blog/cve-2014-1761-alley-compromise/
http://arstechnica.com/security/2014/03/zero-day-vulnerability-in-microsoft-word-under-active-attack...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.On Feb. 11, FireEye researchers identified a zero-day exploit in Internet Explorer 10.
The exploit was being used in Operation SnowMan that compromised the U.S. Veterans of Foreign Wars website.
Software: Microsoft Internet Explorer
Known/fameous malware:
Elderwood exploit kit.
Links:
https://technet.microsoft.com/en-us/library/security/ms14-012.aspx
https://www.symantec.com/security_response/vulnerability.jsp?bid=66040
http://researchcenter.paloaltonetworks.com/2014/07/beginning-end-use-free-exploitation/
http://www.computerworld.com/article/2489451/malware-vulnerabilities/-elderwood--hackers-still-setti...
http://www.darkreading.com/researchers-recent-zero-day-attacks-linked-via-common-exploit-package/d/d...
https://ae.norton.com/security_response/print_writeup.jsp?docid=2014-031311-2821-99
https://hackermedicine.com/how-the-elderwood-platform-is-fueling-2014s-zero-day-attacks/
http://104.239.158.70/elderwood-attack-platform-linked-multiple-internet-explorer-zero-day-attacks-s...
http://www.cio.com/article/2376236/security0/-elderwood--hackers-continue-to-set-pace-for-zero-day-e...
https://www.symantec.com/connect/blogs/attackers-targeting-other-ie-zero-day-vulnerability-covered-m...
https://www.symantec.com/connect/blogs/operation-backdoor-cut-targeted-basketball-community-ie-zero-...
тАЬUse-after-freeтАЭ error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The flaw was most likely introduced in August 2013. The vulnerability was reported to vendor - 2014-02-04.
Private fully functional exploit code existed long before the vendor released security patch. We consider this vulnerability a zero-day.
Software: Microsoft Internet Explorer
Known/fameous malware:
JS/Exploit.CVE-2014-0307.
Links:
https://technet.microsoft.com/library/security/ms14-012
https://www.symantec.com/security_response/vulnerability.jsp?bid=66032
http://ec2-75-101-158-109.compute-1.amazonaws.com/news/stories/33351-microsoft-internet-explorer-mem...
http://www.csoonline.com/article/2888040/cyber-attacks-espionage/the-top-software-exploit-of-2014-th...
http://www.techcentral.ie/top-exploit-2014-stuxnet-2010/
https://github.com/CCrashBandicot/helpful/blob/master/CVE-2014-0307.rb
Double free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Wen Guanxing of Venustech, The Google Security Team and FireEye were working at the vulnerability.
FireEye dubbed the attack exploiting the vulnerability "Operation GreedyWonk".
The vulnerability was exploited to compromise sites of:
Software: Adobe Flash Player
Known/fameous malware:
Elderwood exploit kit.
Links:
https://helpx.adobe.com/security/products/flash-player/apsb14-07.html
https://www.alienvault.com/blogs/labs-research/analysis-of-an-attack-exploiting-the-adobe-zero-day-c...
https://www.trustwave.com/Resources/SpiderLabs-Blog/Deep-Analysis-of-CVE-2014-0502-%E2%80%93-A-Doubl...
https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=655
https://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html
https://blog.threattrack.com/adobe-exploit-cve-2014-0502/
http://www.benhayak.com/2014/05/deep-analysis-of-cve-2014-0502-double.html
http://www.welivesecurity.com/2014/10/31/two-recently-patched-adobe-flash-vulnerabilities-now-used-e...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27443
http://www.theregister.co.uk/2014/02/20/flash_adobe_posts_emergency_fix/
https://nakedsecurity.sophos.com/2014/02/21/adobe-pushes-out-critical-flash-update-second-zero-day-h...
http://dailyleet.com/how-the-elderwood-platform-is-fueling-2014s-zero-day-attacks/
https://www.scmagazineuk.com/chinese-spies-launch-new-adobe-zero-day-attack/article/541288/
http://arstechnica.com/security/2014/02/adobe-releases-emergency-flash-update-amid-new-zero-day-driv...
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.A zero-day exploit hosted on a breached website based in the U.S Military. The vulnerability was used in the wild as part of "Operation SnowMan".
Software: Microsoft Internet Explorer
Known/fameous malware:
Trojan.Malscript
Trojan.Swifi.
Backdoor.Moudoor
Elderwood exploit kit.
Links:
https://technet.microsoft.com/library/security/2934088
https://www.fireeye.com/blog/threat-research/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2...
http://securityaffairs.co/wordpress/25002/hacking/elderwood-platform-still-active.html
https://technet.microsoft.com/en-us/library/security/ms14-012.aspx
https://www.symantec.com/connect/blogs/emerging-threat-ms-ie-10-zero-day-cve-2014-0322-use-after-fre...
https://labs.bromium.com/2014/02/25/dissecting-the-newest-ie10-0-day-exploit-cve-2014-0322/
http://thehackernews.com/2014/02/cve-2014-0322-internet-explorer-zero.html
https://blogs.forcepoint.com/security-labs/cyber-criminals-expand-use-cve-2014-0322-patch-tuesday
http://securityaffairs.co/wordpress/22224/cyber-crime/fireeye-watering-hole-attack.html
http://www.zdnet.com/article/new-internet-explorer-10-zero-day-exploit-targets-u-s-military/
http://www.eweek.com/blogs/security-watch/microsoft-ie-zero-day-exploited-in-the-wild.html
http://54.204.81.18/news/stories/269204-cyber-criminals-expand-use-of-cve-2014-0322-before-patch-tue...
SQL Injection
The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable website and execute arbitrary SQL commands in web application database.
Successful exploitation may allow an attacker to gain unauthorized access to the vulnerable system.
Note: this vulnerability was being actively exploited.
Software: TYPO3
Known/fameous malware:
ASLR bypass
The vulnerability allows a remote attacker to bypass security restrictions on the target system.Software: Microsoft .NET Framework
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.Microsoft and FireEye first discussed this issue in November, 2013.
Software: Microsoft XML Core Services
Infinite loop
The vulnerability allows a remote attacker to cause DoS conditions on the target system.On April 24, 2014, the Apache Software Foundation (ASF) released an advisory warning that a patch issued in March, 2 for a zero-day vulnerability in Apache Struts up to version 2.3.16.1, did not fully patch the vulnerabilities (CVE-2014-0094 or CVE-2014-0050).
Software: Apache Struts
Links:
http://mail-archives.apache.org/mod_mbox/www-announce/201402.mbox/%3C52F373FC.9030907@apache.org%3E
https://www.symantec.com/connect/blogs/emerging-threat-apache-struts-zero-day-cve-2014-0050-0094-dos...
https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-0050--Exploit-with-Boundaries,-Loops-wi...
http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000017.html
https://www.symantec.com/connect/blogs/emerging-threat-apache-struts-zero-day-cve-2014-0050-0094-dos-and-remote-code-execution-vulner
http://www.ehackingnews.com/2014/02/cve-2014-0050-apache-tomcat-vulnerable.html
http://telussecuritylabs.com/threats/show/TSL20140206-02
http://www.javaworld.com/article/2097428/enterprise-java/denial-of-service-vulnerability-puts-apache...
Integer underflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Exploited by DarkHotel APT.
The vulnerability survived for 84 days after update in November 2013.
Software: Adobe Flash Player
Links:
https://helpx.adobe.com/security/products/flash-player/apsb14-04.html
https://securingtomorrow.mcafee.com/mcafee-labs/flash-zero-day-vulnerability-cve-2014-0497-lasts-84-...
https://blogs.technet.microsoft.com/mmpc/2014/02/17/a-journey-to-cve-2014-0497-exploit/
https://www.fireeye.com/blog/threat-research/2015/03/flash_in_2015.html
http://securityaffairs.co/wordpress/21937/cyber-crime/adobe-flash-player-fixed.html
https://business.kaspersky.com/darkhotel-hackingteam/4357/
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Sanshiro
Improper access control
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to improper access control and incorrect validation of the szScreen field when processing file uploads within the CimWebServer component. A remote unauthenticated attacker can upload and execute arbitrary file on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability has been exploited in targeted attacks.
According to ICS-CERT, the vulnerability has been exploited in the wild since at least since January 2012. The vulnerability has been exploited in Sandworm campaign.
Software: CIMPLICITY
Known/fameous malware:
BlackEnergy
Links:
https://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-281-01B
https://ics-cert.us-cert.gov/advisories/ICSA-14-023-01
https://ge-ip.force.com/communities/servlet/fileField?retURL=%2Fcommunities%2Fapex%2FKnowledgeDetail...
https://ge-ip.force.com/communities/servlet/fileField?retURL=%2Fcommunities%2Fapex%2FKnowledgeDetail...
http://www.zerodayinitiative.com/advisories/ZDI-14-016/
SQL injection
The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to the XML-RPC script using the "what" parameter and view, add, modify or delete information in the back-end database.
Successful exploitation may allow an attacker to gain unauthorized access to the vulnerable system.
Note: this vulnerability was being actively exploited.
The vulnerability was discovered and reported to Revive Adserver team by Florian Sander.
The vulnerability is considered to be connected with attacks on web site centralpark[.]com and high-traffic site clipconverter[.]cc
Software: Revive Adserver
Type confusion
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was reported by Adobe as being exploited in the wild. The attackers used Microsoft Word documents with embedded malicious Flash (.swf) content.
Software: Adobe Flash Player
Known/fameous malware:
Troj/SWFExp-CH (Sophos)
Trojan horse Exploit_c.YZX (AVG)
Exploit.Win32.CVE-2013 (Ikarus)
HEUR:Exploit.SWF.CVE-2013-5331.a (Kaspersky)
Exploit:Win32/CVE-2013-5331 (Microsoft)
SWF/Exploit.CVE-2013-5331.A trojan (Eset)
Trojan.Mdropper (Symantec)
Links:
https://helpx.adobe.com/security/products/flash-player/apsb13-28.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27558
http://eromang.zataz.com/2015/12/24/cve-2013-5331-adobe-flash-player-type-confusion-remote-code-exec...
http://blog.malwaretracker.com/2014/01/cve-2013-5331-evaded-av-by-using.html
http://eromang.zataz.com/2015/12/24/cve-2013-5331-adobe-flash-player-type-confusion-remote-code-exec...
http://freerepairwindowserrors.com/spytips/Guide-to-Remove-SWFExploit.CVE-2013-5331.A_16_203811.html
ASLR bypass
The vulnerability allows a remote attacker to bypass certain security restrictions.Software: Microsoft Office
Sugnature verification bypass
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Windows
Links:
https://blogs.technet.microsoft.com/srd/2013/12/10/ms13-098-update-to-enhance-the-security-of-authen...
https://technet.microsoft.com/en-us/library/security/ms13-098.aspx
https://www.symantec.com/security_response/vulnerability.jsp?bid=64079
http://blog.talosintel.com/2013/12/microsoft-update-tuesday-december-2013.html
http://blog.trendmicro.com/trendlabs-security-intelligence/december-patch-tuesday-addresses-tiff-vul...
http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html
https://www.corero.com/resources/files/security_advisories/advisory_CNS_IPS_Microsoft_nVerifyTrust_C...
https://www.symantec.com/connect/blogs/microsoft-patch-tuesday-december-2013
https://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000559.aspx
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.The vulnerability was discovered by the Adallom company and the attack was dubbed "Ice Dagger". The attackers used the vulnerability to steal Microsoft Office 365 authentication token. The victim of the unnamed company received an email with a link to attachment, located on a hidden server within TOR network. The vulnerability was reported to Microsoft in late May 2013.
Software: Microsoft Office
Links:
https://technet.microsoft.com/en-us/library/security/ms13-104.aspx
https://www.symantec.com/security_response/vulnerability.jsp?bid=64092
http://blog.talosintel.com/2013/12/microsoft-update-tuesday-december-2013.html
https://www.scmagazine.com/patch-tuesday-update-addresses-24-bugs-including-exploited-tiff-zero-day/...
http://news.softpedia.com/news/Newly-Patched-Office-365-Vulnerability-Used-in-Ice-Dagger-Targeted-At...
http://it.toolbox.com/blogs/securitymonkey/flaw-in-microsoft-office-365-allows-perfect-crime-58421
Privilege escalation
The vulnerability allows a local attacker to obtain elevated privileges on the target system.Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the Reader sandbox.
Kaspersky Lab revealed the vulnerability was used in Epic Turla (cyber-espionage campaigns).
Software: Windows
Known/fameous malware:
PDF:Exploit.CVE-2013-5065.A
Gen:Trojan.Heur.FU.ku3@aSHWAmji
Links:
https://www.fireeye.com/blog/threat-research/2013/12/cve-2013-33465065-technical-analysis.html
https://www.fireeye.com/blog/threat-research/2013/11/ms-windows-local-privilege-escalation-zero-day-...
https://technet.microsoft.com/en-us/library/security/2914486.aspx
https://blogs.technet.microsoft.com/msrc/2013/11/27/microsoft-releases-security-advisory-2914486/
https://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/
https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Kernel-is-calling-a-zero(day)-pointer-%E2%80...
https://penturalabs.wordpress.com/2013/12/11/ndproxy-privilege-escalation-cve-2013-5065/
http://securityaffairs.co/wordpress/20092/hacking/windows-xp-zero-day.html
https://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerabilit...
https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attac...
https://www.scmagazine.com/windows-xp-zero-day-under-active-attack/article/543166/
https://www.fireeye.jp/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-zero-day-attacks-in...
https://securingtomorrow.mcafee.com/mcafee-labs/product-coverage-and-mitigation-for-cve-2013-5065/
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerabilty was introduced on 07.27.2005, but publically disclosed later by Xiaobo Chen and Dan Caselden of FireEye.
The vulnerability has been exploited by the APTgroup behind the 2009 Aurora attack. The exploit uses a technique ROP (return-oriented-programming). According to FireEye, the attack has a link to the infrastructure used in Operation DeputyDog and Operation Ephemeral Hydra, which began in August and targeted organizations in Japan.
Software: InformationCardSigninHelper Class ActiveX control
Links:
https://technet.microsoft.com/en-us/library/security/ms13-090.aspx
https://www.fireeye.com/blog/threat-research/2013/11/new-ie-zero-day-found-in-watering-hole-attack.h...
https://blogs.technet.microsoft.com/msrc/2013/11/11/activex-control-issue-being-addressed-in-update-...
https://blogs.technet.microsoft.com/srd/2013/11/12/technical-details-of-the-targeted-attack-using-ie...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27146
http://eromang.zataz.com/2015/12/23/cve-2013-3918-cardspaceclaimcollection-activex-integer-underflow...
http://www.darkreading.com/new-ie-vulnerability-found-in-the-wild-sophisticated-web-exploit-follows/...?
http://www.securityweek.com/microsoft-patches-vulnerability-attackers-used-target-ie-users
https://blog.threattrack.com/a-look-inside-a-cve-2013-3918-exploit/
https://www.fireeye.jp/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-zero-day-attacks-in...
http://www.zdnet.com/article/ie-zero-day-used-by-cyber-arms-dealers-and-chinese-hackers/
https://support.ixiacom.com/about-us/news-events/corporate-blog/completing-deputydog-apt
http://www.darkreading.com/vulnerabilities---threats/fireeye-releases-2013-lab-performance-stats/d/d...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The meta date of the files were set to October 17, 2013, which may suggest a creation time of this exploit.
Attacks leveraging this zero-day exploit revealed that the Hangover group, believed to operate from India, has compromised 78 computers, 47 percent of those in Pakistan. The attacks observed are very limited and carefully carried out against selected computers, largely in the Middle East and South Asia.
Software: Microsoft Office
Links:
https://technet.microsoft.com/en-us/library/security/2896666.aspx
https://technet.microsoft.com/en-us/library/security/ms13-096
https://securingtomorrow.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-micro...
https://securingtomorrow.mcafee.com/business/security-connected/updates-and-mitigation-to-cve-2013-3...
https://blogs.technet.microsoft.com/srd/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-...
https://www.fireeye.com/blog/threat-research/2013/11/the-dual-use-exploit-cve-2013-3906-used-in-both...
https://www.crowdstrike.com/blog/analysis-cve-2013-3906-exploit/
http://www.primalsecurity.net/analysis-of-malicious-document-using-cve-2013-3906/
http://blog.trendmicro.com/trendlabs-security-intelligence/how-to-avoid-the-latest-microsoft-office-...
http://securityaffairs.co/wordpress/19460/hacking/microsoft-cve-2013-3906-zero-day.html
https://www.symantec.com/connect/forums/if-sep-daily-definition-covers-exploit-cve-2013-3906
Privilege escalation
The vulnerability allows a local attacker to obtain elevated privileges on the target system.The vulnerability was exploited against Android devices in October and November 2013. The vulnerability is originally in SE Linux kernel.
Software: Google Android
Known/fameous malware:
Gooligan.
Links:
https://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-...
http://www.openwall.com/lists/oss-security/2013/11/14/11
http://www.helix-os.com/the-huge-disappointment-of-se-android/
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/arch/arm/include/asm/uaccess....
https://arstechnica.com/security/2016/11/1-million-android-accounts-compromised-by-android-malware-c...
Security bypass
The vulnerability allows a remote attacker to bypass security restrictions on the target system.Software: Dir-100
Links:
http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/
https://packetstormsecurity.com/files/123848/D-Link-Backdoor-Czechr.html
http://www.securityspace.com/smysecure/catid.html?id=1.3.6.1.4.1.25623.1.0.103810
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27130
https://krebsonsecurity.com/2013/12/important-security-update-for-d-link-routers/
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Used in Pawn Storm campaign.
A zero-day was used in highly targeted, low-volume attacks in Korea,
Hong Kong, and the United States, as early as September 18th, 2013.
Software: Microsoft Internet Explorer
Links:
https://technet.microsoft.com/en-us/library/security/ms13-080.aspx
https://blogs.technet.microsoft.com/srd/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limi... https://technet.microsoft.com/library/security/ms13-080 http://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-pawn-storm-fast-facts
https://blogs.forcepoint.com/security-labs/zero-day-attack-internet-explorer-cve-2013-3897-goes-high...
http://blog.talosintel.com/2013/10/ie-zero-day-cve-2013-3897-youve-been.html
https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=607
https://www.symantec.com/security_response/vulnerability.jsp?bid=62811
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27102
https://media.paloaltonetworks.com/lp/endpoint-security/blog/cve-2013-3897-analysis-of-yet-another-i...
http://eromang.zataz.com/2015/12/23/cve-2013-3897-microsoft-internet-explorer-cdisplaypointer-use-af...
https://vulners.com/metasploit/MSF:EXPLOIT/WINDOWS/BROWSER/MS13_080_CDISPLAYPOINTER
https://www.symantec.com/connect/blogs/new-internet-explorer-zero-day-targeted-attacks-against-korea...
http://www.benhayak.com/2013_11_01_archive.html
https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Technical-Aspects-of-Exploiting-IE-Zero-Day-...
https://krebsonsecurity.com/2013/10/adobe-microsoft-push-critical-security-fixes-3/#more-23010
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability used ROP-chain technique and was exploited in Campaign Operation DeputyDog.
The vulnerability was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well.
Software: Microsoft Internet Explorer
Links:
https://technet.microsoft.com/en-us/library/security/2887505
https://technet.microsoft.com/en-us/library/security/ms13-080
https://blogs.technet.microsoft.com/srd/2013/09/17/cve-2013-3893-fix-it-workaround-available/
https://blogs.technet.microsoft.com/srd/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limi...
https://nakedsecurity.sophos.com/2013/10/11/anatomy-of-an-exploit-ie-zero-day-part-1/
https://nakedsecurity.sophos.com/2013/10/25/anatomy-of-an-exploit-inside-the-cve-2013-3893-internet-...
https://www.f-secure.com/en/web/labs_global/cve-2013-3893
https://community.rapid7.com/community/metasploit/blog/2013/09/30/metasploit-releases-cve-2013-3893-...
https://www.symantec.com/security_response/vulnerability.jsp?bid=62453
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=70073
http://eromang.zataz.com/2015/12/22/cve-2013-3893-microsoft-internet-explorer-setmousecapture-uaf/
https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-part-2-zero-day-exploit-ana...
https://sgros-students.blogspot.com/2014/01/exploiting-and-analysing-cve-2013-3893.html
https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/product-coverage-and-mitigation...
https://securityintelligence.com/trusteers-exploit-prevention-stops-attacks-targeting-new-ie-zero-da...
https://media.paloaltonetworks.com/lp/endpoint-security/blog/cve-2013-3893-analysis-of-the-new-ie-0-...
http://tipstrickshack.blogspot.com/2013/10/exploit-for-all-ie-versioncve-2013-3893.html
Security bypass
The vulnerability allows a remote attacker to bypass security restrictions on the target system.Software: vBulletin
Known/fameous malware:
PHP/Exploit.CVE-2013-6129.A virus.
Security bypass
The vulnerability allows a renote attacker to bypass security restriction on the target system.The vulnerability in Android's component Apache Harmony led to multiple compromises of a bitcoin transactions.
Software: Google Android
Arbitrary PHP code execution
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.The vulnerability has been exploited from November 2012 till August 2013.
Software: Revive Adserver
Denial of service
The vulnerability allows a remote attacker to cause DoS conditions on the target system.We are aware of in the wild exploitation of this vulnerability before official patch release.
This vulnerability was discovered by Maxim Shudrak.
Software: ISC BIND
Arbitrary file upload
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.The weakness was disclosed 08/01/2013 by Jens Hinrichsen.
Software: Joomla!
Links:
https://developer.joomla.org/security/563-20130801-core-unauthorised-uploads.html
http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_...
http://www.kb.cert.org/vuls/id/639620
http://niiconsulting.com/checkmate/2013/08/critical-joomla-file-upload-vulnerability/
https://blog.sucuri.net/2013/08/joomla-media-manager-attacks-in-the-wild.html
http://holisticinfosec.blogspot.com/2013/10/joomla-vulnerabilities-responsible.htm
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability reffers to "Waterring hole attack".
Software: Microsoft Internet Explorer
Links:
https://h41382.www4.hpe.com/gfs-shared/downloads-226.pdf
https://technet.microsoft.com/en-us/library/security/ms13-055.aspx
https://www.fireeye.com/blog/threat-research/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-explo...
https://www.symantec.com/security_response/vulnerability.jsp?bid=60975
http://www.zdnet.com/article/microsoft-admits-internet-explorer-flaw-targeted-by-hackers/
https://securingtomorrow.mcafee.com/mcafee-labs/new-zero-day-attack-copies-earlier-flash-exploitatio...
http://www.computerworld.com/article/2483926/microsoft-windows/targeted-attacks-exploit-now-patched-...
https://media.paloaltonetworks.com/lp/endpoint-security/blog/cve-2013-3163-internet-explorer-vulnera...
https://blogs.technet.microsoft.com/srd/2013/07/10/running-in-the-wild-not-for-so-long/
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Symantec has seen the exploitation being used in targeted attacks since May, but it has been limited to users in Japan and the volume of attacks has been minimal.
Software: Ichitaro
Known/fameous malware:
Trojan.Tarodrop.M.
Links:
http://www.justsystems.com/jp/info/js13002.html
http://jvn.jp/en/jp/JVN98712361/index.html
http://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000058.html
https://www.symantec.com/security_response/writeup.jsp?docid=2013-061907-5714-99
https://www.symantec.com/connect/blogs/targeted-attack-exploits-ichitaro-vulnerability-0
https://www.symantec.com/connect/nl/blogs/targeted-attack-exploits-ichitaro-vulnerability?page=1
Array indexing error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The exploit was released by security research group Packet Storm Security.
Software: Java SE
Known/fameous malware:
Styx exploit kit, previously known as Kein
Fiesta EK
Links:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=26978
https://www.zscaler.com/blogs/research/exploring-java-vulnerability-cve-2013-2465-used-fiesta-ek
http://infosecdailydigest.com/2013/08/24/metasploit-module-demo-for-cve-2013-2465-java-storeimagearr...
https://sgros-students.blogspot.com/2014/01/java-cve-2013-2465-vulnerability-and.html
http://www.pcworld.com/article/2046821/cybercriminals-add-new-exploit-for-recently-patched-java-vuln...
Denial of service
The vulnerability allows a remote attacker to cause DoS conditions on the target system.This vulnerability was the cause of a record-sized NTP reflection attack in late 2013 and early 2014. We consider this a zero-day vulnerability as it was exploited in the wild before the official patch release.
Software: ntp
Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211
http://www.vmware.com/security/advisories/VMSA-2014-0002.html
https://packetstormsecurity.com/files/125774
http://www.kb.cert.org/vuls/id/348126
https://www.us-cert.gov/ncas/alerts/TA13-088A
http://christian-rossow.de/articles/Amplification_DDoS.php
https://www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-refle...
http://www.kb.cert.org/vuls/id/348126
http://christian-rossow.de/articles/Amplification_DDoS.php
http://bugs.ntp.org/show_bug.cgi?id=1532
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was reported by Andrew Lyons and Neel Mehta of Google Inc.
Using the samples provided by Microsoft, Romang scoured GoogleтАЩs cache and found the earliest document that attempted to fetch the exploit dated from February, 2013. The document referenced territory disputes between China and the Philippines.
However, Romang uncovered another Word document created in 2009 that, according to GoogleтАЩs Virus Total service, would also exploit the flaw Microsoft patched. The fileтАЩs title тАЬThe corruption of MahathirтАЭ referred to a Malaysian politician, fitting MicrosoftтАЩs list of possible targets. Both documents to a Bridging Links URL.
The vulnerability might have been spotted in the wild, with campaigns starting as early as 2009. Microsoft believe attacks were limited to Indonesia and Malaysia.
Software: Microsoft Office
Known/fameous malware:
Trojan.Mdropper.
Links:
https://technet.microsoft.com/en-us/library/security/ms13-051.aspx
https://www.symantec.com/security_response/vulnerability.jsp?bid=60408
https://www.symantec.com/connect/blogs/microsoft-office-cve-2013-1331-coverage
https://media.paloaltonetworks.com/lp/endpoint-security/blog/cve-2013-1331-a-zero-day-disclosed.html
http://eromang.zataz.com/2013/06/13/ms13-051-cve-2013-1331-what-we-know-about-microsoft-office-zero-...
https://threatpost.com/important-office-2003-zero-day-deserves-second-look/100990/
https://blogs.technet.microsoft.com/srd/2013/06/11/ms13-051-get-out-of-my-office/
http://dataprotectioncenter.com/general/microsoft-office-cve-2013-1331-coverage/
http://blog.trendmicro.com/trendlabs-security-intelligence/light-june-2013-patch-tuesday-is-no-reaso...
Privilege escalation
The vulnerability allows a local attacker to obtain elevated privileges on the target system.Tavis Ormandy, a Google security engineer, reported a critical bug to Microsoft only five days before going public.
The vulnerability has being used by Carbanak group.
Software: Windows
Known/fameous malware:
Cidox/Rovnix Bootkit
PowerLoader
Directory traversal
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.Software: ColdFusion
Links:
http://www.adobe.com/support/security/advisories/apsa13-03.html
http://www.computerworld.com/article/2497237/security0/adobe-warns-of-unpatched-critical-flaw-in-col...
http://mac-security.blogspot.com/2013/05/new-critical-adobe-security-updates.html
http://www.infosecurity-magazine.com/news/anonymous-said-to-be-exploiting-coldfusion-in/
https://www.corero.com/resources/files/security_advisories/advisory_CNS_IPS_Microsoft_Adobe_ColdFusi...
http://www.securityweek.com/server-washington-state-courts-office-hacked-sensitive-data-exposed
https://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000492.aspx
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability has been exploited in watering hole attack against Department of Labor (DoL). Used in Pawn Storm campaign.
Software: Microsoft Internet Explorer
Links:
https://www.fireeye.com/blog/threat-research/2013/05/ie-zero-day-is-used-in-dol-watering-hole-attack...
https://technet.microsoft.com/en-us/library/security/2847140.aspx
https://technet.microsoft.com/en-us/library/security/ms13-may.aspx
https://technet.microsoft.com/en-us/library/security/ms13-038
https://nakedsecurity.sophos.com/2013/05/09/microsoft-rushes-out-cve-2013-1347-fix-it-for-the-latest...
https://securityintelligence.com/cve-2013-1347-microsoft-internet-explorer-cgenericelement-object-us...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=26721
http://stopmalvertising.com/malware-reports/cve-2013-1347-new-internet-explorer-8-0-day-used-in-wate...
https://vulners.com/metasploit/MSF:EXPLOIT/WINDOWS/BROWSER/IE_CGENERICELEMENT_UAF
https://krebsonsecurity.com/2013/05/zero-day-exploit-published-for-ie8/
https://blogs.forcepoint.com/security-labs/internet-explorer-zero-day-vulnerability-cve-2013-1347-up...
https://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000479.aspx
https://blog.qualys.com/laws-of-vulnerabilities/2013/05/04/new-0-day-in-microsoft-internet-explorer-...
https://www.threatconnect.com/blog/threatconnect-gets-root-targeted-exploitation-campaigns/
Cross-site scripting
The vulnerability allows a remote attacker to obtain elevated privileges on the target system.Software: Microsoft SharePoint Server
PHP including
The vulnerability allows a remote attacker to include arbitrary files on the target system.Software: Roundcube
Known/fameous malware:
Exploit-FHV!CVE2013-1493 (McAfee)
Exp/20131493-G (Sophos)
Exp/20131493-A (Sophos)
Exploit.Java.CVE-2013-1493.gen (Kaspersky)
Java/CVE_2013_1493.NT!exploit
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Microsoft Silverlight
Known/fameous malware:
Exploit kits: Angler, Archie, Astrum, Fiesta, Hanjuan, Infinity (Exploit kit), Neutrino, Nuclear Pack, RIG.
Links:
https://technet.microsoft.com/en-us/library/security/ms13-022.aspx
https://www.zscaler.com/blogs/research/exploit-kits-anatomy-silverlight-exploit
https://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf
https://www.symantec.com/security_response/vulnerability.jsp?bid=58327
http://journeyintoir.blogspot.com/2014/05/cve-2013-0074-3896-silverlight-exploit.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27612
http://www.vxsecurity.sg/2014/06/18/technical-tear-down-fiesta-exploit-kit-silverlight-exploit-cve-2...
http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-a-silverlight-exploit/
https://blog.malwarebytes.com/threat-analysis/2014/05/malvertising-campaign-on-popular-site-leads-to...
http://blogs.cisco.com/security/angling-for-silverlight-exploits
https://www.scmagazine.com/more-exploits-including-silverlight-attack-packed-in-nuclear-kit/article/...
http://arstechnica.com/security/2014/05/move-over-java-drive-by-attacks-exploiting-microsoft-silverl...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability allows a remote user to execute arbitrary code on the target system via MC Rat (Trojan). The vulnerability was found with the help of Malware Protection Cloud (MPC).
The vulnerability turned out to have been exploited in Sun Shop Campaign and related to breach at security firm Bit9.
Software: Java SE
Known/fameous malware:
Trojan.Naid, Trojan.Dropper (Symantec).
Links:
https://www.fireeye.com/blog/threat-research/2013/02/yaj0-yet-another-java-zero-day-2.html
https://twitter.com/jduck/status/307629902574800897
http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html
http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/1915099.xml
https://blogs.oracle.com/security/entry/security_alert_cve_2013_1493
https://www.symantec.com/connect/blogs/latest-java-zero-day-shares-connections-bit9-security-inciden...
https://krebsonsecurity.com/2013/03/new-java-0-day-attack-echoes-bit9-breach/
Arbitrary code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Adobe Flash Player
Links:
https://www.adobe.com/support/security/bulletins/apsb13-08.html
https://www.intego.com/mac-security-blog/adobe-squashes-two-exploits-in-the-wild-designed-to-target-...
http://www.computerworlduk.com/it-vendors/new-emergency-flash-update-as-hackers-hit-firefox-3428746/
https://blog.basefarm.com/blog/security-updates-available-for-adobe-flash-player-apsb13-08/
http://doa.alaska.gov/ets/security/S_Advisory/sa2013-023.pdf
http://www.macworld.co.uk/news/apple/adobe-springs-emergency-flash-update-says-hackers-hitting-firef...
https://www.auscert.org.au/render.html?it=17093
http://www.totalsofttech.com.ph/adobe-springs-emergency-flash-update-says-hackers-hitting-firefox/
http://krebsonsecurity.com/tag/cve-2013-0648/
http://www.theregister.co.uk/2013/02/27/adobe_issues_two_critical_flash_vuln_patches/
Arbitrary code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Adobe Flash Player
Links:
http://www.adobe.com/support/security/bulletins/apsb13-08.html
http://doa.alaska.gov/ets/security/S_Advisory/sa2013-023.pdf
https://krebsonsecurity.com/2013/02/flash-player-update-fixes-zero-day-flaws/#more-19186
http://www.techworld.com/news/security/adobe-pushes-out-emergency-flash-update-as-hackers-hit-firefo...
https://www.scmagazine.com/adobe-hurries-update-to-fix-flash-zero-day-vulnerabilities/article/542241...
http://www.computerworld.com/article/2495576/malware-vulnerabilities/adobe-springs-emergency-flash-u...
http://www.theregister.co.uk/2013/02/27/adobe_issues_two_critical_flash_vuln_patches/
https://blog.qualys.com/laws-of-vulnerabilities/2013/02
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The sandbox vulnerability was dubbed as "666" by FireEye. CVE-2013-0640 and CVE-2013-0641 have been exploited in MiniDuke, Zegost, PlugX Malware Campaign attacks.
Software: Adobe Reader
Links:
https://www.fireeye.com/blog/threat-research/2013/02/its-a-kind-of-magic-1.html
http://www.adobe.com/support/security/advisories/apsa13-02.html
http://www.adobe.com/support/security/bulletins/apsb13-07.html
http://blog.trendmicro.com/trendlabs-security-intelligence/zero-day-vulnerability-hits-adobe-reader/
https://www.symantec.com/security_response/vulnerability.jsp?bid=57947
http://blog.opensecurityresearch.com/2013/10/analysis-of-malware-rop-chain.html
http://hooked-on-mnemonics.blogspot.com/2013/02/detecting-pdf-js-obfuscation-using.html
https://nakedsecurity.sophos.com/2013/02/14/no-patch-yet-for-pdf-exploits/
https://access.redhat.com/security/cve/cve-2013-0641
http://www.securityweek.com/latest-adobe-zero-day-serious-business-attackers-escape-adobe-reader-san...
https://www.slashgear.com/adobe-says-acrobat-and-reader-vulnerabilities-exploited-with-malicious-pdf...
http://www.pcworld.com/article/2028603/adobe-readies-emergency-patches-for-reader-acrobat.html
http://www.eweek.com/security/adobe-issues-reader-acrobat-security-updates-to-stave-off-attacks
https://securingtomorrow.mcafee.com/mcafee-labs/emerging-stack-pivoting-exploits-bypass-common-secur...
https://www.fireeye.jp/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-zero-day-attacks-in...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The sandbox vulnerability was dubbed as "666" by FireEye. CVE-2013-0640 and CVE-2013-0641 have been exploited in MiniDuke, Zegost, PlugX Malware Campaign attacks.
Software: Adobe Reader
Links:
https://www.fireeye.com/blog/threat-research/2013/02/its-a-kind-of-magic-1.html
http://www.adobe.com/support/security/advisories/apsa13-02.html
http://www.adobe.com/support/security/bulletins/apsb13-07.html
http://www.kb.cert.org/vuls/id/422807
https://labs.portcullis.co.uk/blog/cve-2013-0640-adobe-reader-xfa-oneofchild-un-initialized-memory-v...
http://www.enigmasoftware.com/pdf-cve20130640-vulnerability-exploited-miniduke-zegost-plugx/
http://blog.trendmicro.com/trendlabs-security-intelligence/zero-day-vulnerability-hits-adobe-reader/
http://blog.opensecurityresearch.com/2013/10/analysis-of-malware-rop-chain.html
https://securelist.com/blog/incidents/31112/the-miniduke-mystery-pdf-0-day-government-spy-assembler-...
http://vinsula.com/2013/04/17/cve-2013-0640-adobe-pdf-zero-day-malware/
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was discovered by Shadowserver Foundation.
The exploit was used in a cyber espionage campaign dubbed тАЬLadyBoyle".
Software: Adobe Flash Player
Links:
http://www.adobe.com/support/security/bulletins/apsb13-04.html
https://www.invincea.com/2013/02/exploit-down-analysis-and-protection-against-adobe-flash-exploit-cv...
http://blog.malwaremustdie.org/2013/02/cve-2013-0634-this-ladyboyle-is-not.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=26455
http://www.enigmasoftware.com/exploitswfcve20130634a-removal/
https://www.fireeye.com/blog/threat-research/2013/02/lady-boyle-comes-to-town-with-a-new-exploit.htm...
https://vulners.com/metasploit/MSF:EXPLOIT/WINDOWS/BROWSER/ADOBE_FLASH_REGEX_VALUE
https://www.intego.com/mac-security-blog/adobe-resolves-flash-player-flaws-being-exploited-in-the-wi...
http://www.spywareremove.com/removeexploitswfcve20130634a.html
https://eromang.zataz.com/2013/02/26/gong-da-gondad-exploit-pack-add-flash-cve-2013-0634-support/
https://krebsonsecurity.com/tag/cve-2013-0634/
http://www.infoworld.com/article/2613576/security/adobe-blames-na-ve-office-users-for-latest-flash-p...
https://nakedsecurity.sophos.com/2013/02/08/adobe-patches-flash-heads-off-attacks-on-windows-and-app...
https://www.intego.com/mac-security-blog/two-adobe-vulnerabilities-attacked-in-the-wild-now-patched/
https://www.invincea.com/2013/02/exploit-down-analysis-and-protection-against-adobe-flash-exploit-cv...
http://www.securityweek.com/adobe-patches-flash-player-against-active-attacks
https://www.fireeye.jp/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-zero-day-attacks-in...
Buffer overflow
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was reported to Adobe by Sergey Golovanov and Alexander Polyakov of Kaspersky.
The vulnerability was being used in a series of targeted attacks mostly against human rights activists and political dissidents from Africa and the Middle East.
Software: Adobe Flash Player
Known/fameous malware:
Exploit: SWF/CVE-2013-0633.
Links:
http://www.adobe.com/support/security/bulletins/apsb13-04.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=26453
https://www.symantec.com/security_response/vulnerability.jsp?bid=57788
http://krebsonsecurity.com/tag/cve-2013-0633/
https://www.fireeye.com/blog/threat-research/2013/02/lady-boyle-comes-to-town-with-a-new-exploit.htm...
https://eromang.zataz.com/2013/02/26/gong-da-gondad-exploit-pack-add-flash-cve-2013-0634-support/
http://www.kaspersky.com/au/about/news/virus/2013/Kaspersky_Lab_Experts_Credited_for_Identifying_and...
https://securelist.com/blog/research/64215/adobe-flash-player-0-day-and-hackingteams-remote-control-...
http://www.pcworld.com/article/2027916/researchers-surveillance-malware-distributed-via-flash-player-exploit.html
http://www.infoworld.com/article/2613576/security/adobe-blames-na-ve-office-users-for-latest-flash-p...
https://securityledger.com/2013/02/adobe-pushes-fix-for-flash-player-cites-attacks-on-windows-mac-an...
https://www.intego.com/mac-security-blog/two-adobe-vulnerabilities-attacked-in-the-wild-now-patched/
http://www.pcadvisor.co.uk/feature/security/adobe-releases-emergency-flash-fixes-for-two-zero-day-bu...
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Software: Ichitaro
Arbitrary code execution
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The CVE-2013-0422 exploit has also been identified as distributing GameHack and Banki malicious code. The vulnerability was used by Blackhole, Cool Exploit, and Nuclear exploit kits.
Software: Java SE
Known/fameous malware:
TROJ_REVETON.RJ
TROJ_REVETON.RG.
Links:
http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html
http://www.kb.cert.org/vuls/id/625617
http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/
https://www.ibm.com/blogs/psirt/oracle-java-7-security-manager-bypass-vulnerability-cve-2013-0422/
http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-verbose-1896885.html
http://www.ampliasecurity.com/blog/2013/01/10/java_7_update_10_0-day_vulnerability_CVE-2013-0422/
http://www.zdnet.com/article/targeted-attack-against-uae-activist-utilizes-cve-2013-0422-drops-malwa...
http://www.welivesecurity.com/2013/01/11/java-0-day-exploit-cve-2013-0422/
http://www.cparequirements.com/2013/05/apple-facebook-and-microsoft-all-victims-of-java-cve-2013-042...
http://global.ahnlab.com/global/upload/download/documents/1401223631614158.pdf
Authentication bypass
The vulnerability allows a remote attacker to bypass authentication and execute arbitrary code on the target system.
The vulnerability exists due to improper authentication, when password is not configured. A remote unauthenticated attacker can bypass authentication process and execute arbitrary code on the target system.
Note: the vulnerability was being actively exploited.
Software: ColdFusion
Links:
http://www.adobe.com/support/security/bulletins/apsb13-03.html
http://www.adobe.com/support/security/advisories/apsa13-01.html
http://eyeonforensics.blogspot.com/2013/03/a-cold-day-in-e-commerce-guest-post.html
http://doa.alaska.gov/ets/security/S_Advisory/SA2013-093.pdf
http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.p...
http://www.securityweek.com/adobe-warns-attacks-exploiting-coldfusion-vulnerabilities-fix-coming
http://www.livehacking.com/category/vulnerability/adobe/
http://www.pcworld.com/article/2025406/adobe-patches-actively-exploited-coldfusion-vulnerabilities.h...
http://www.itworld.com/article/2714589/security/adobe-warns-of-actively-exploited-coldfusion-flaws.h...
http://www.computerworld.com/article/2494475/malware-vulnerabilities/adobe-warns-of-actively-exploit...
http://www.mis-asia.com/tech/security/adobe-warns-of-actively-exploited-coldfusion-flaws/
Authentication bypass
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to an error in authentication process, when a password is not configured. A remote unauthenticated attacker can gain unauthorized access to restricted directories.
Successful exploitation of this vulnerability results in unauthorized gaining access to the directories.
Note: the vulnerability was being actively exploited.Software: ColdFusion
Links:
http://www.adobe.com/support/security/bulletins/apsb13-03.html
http://www.adobe.com/support/security/advisories/apsa13-01.html
https://www.acunetix.com/vulnerabilities/web/adobe-coldfusion-9-administrative-login-bypass
http://eyeonforensics.blogspot.com/2013/03/a-cold-day-in-e-commerce-guest-post.html
http://doa.alaska.gov/ets/security/S_Advisory/SA2013-093.pdf
http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf
http://www.securityweek.com/adobe-warns-attacks-exploiting-coldfusion-vulnerabilities-fix-coming
http://www.livehacking.com/category/vulnerability/adobe/
http://www.pcworld.com/article/2025406/adobe-patches-actively-exploited-coldfusion-vulnerabilities.html
http://www.itworld.com/article/2714589/security/adobe-warns-of-actively-exploited-coldfusion-flaws.html
http://www.computerworld.com/article/2494475/malware-vulnerabilities/adobe-warns-of-actively-exploited-coldfusion-flaws.html
http://www.mis-asia.com/tech/security/adobe-warns-of-actively-exploited-coldfusion-flaws/
https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Curious-Case-of-the-Malicious-IIS-Module--Pr...
http://blogs.elis.org/isa/attackers-exploited-coldfusion-vulnerability-to-install-microsoft-iis-malw...
Information disclosure
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.Software: ColdFusion
Links:
http://www.adobe.com/support/security/bulletins/apsb13-03.html
http://www.adobe.com/support/security/advisories/apsa13-01.html
https://www.acunetix.com/vulnerabilities/web/adobe-coldfusion-9-administrative-login-bypass
http://eyeonforensics.blogspot.com/2013/03/a-cold-day-in-e-commerce-guest-post.html
http://doa.alaska.gov/ets/security/S_Advisory/SA2013-093.pdf
http://www.securityweek.com/adobe-warns-attacks-exploiting-coldfusion-vulnerabilities-fix-coming
http://www.livehacking.com/category/vulnerability/adobe/
http://www.pcworld.com/article/2025406/adobe-patches-actively-exploited-coldfusion-vulnerabilities.h...
http://www.itworld.com/article/2714589/security/adobe-warns-of-actively-exploited-coldfusion-flaws.h...
http://www.computerworld.com/article/2494475/malware-vulnerabilities/adobe-warns-of-actively-exploit...
http://www.mis-asia.com/tech/security/adobe-warns-of-actively-exploited-coldfusion-flaws/
http://energy.gov/cio/articles/v-063-adobe-coldfusion-bugs-let-remote-users-gain-access-and-obtain-i...
Authentication bypass
The vulnerability allows a remote attacker to bypass authentication and gain unauthorized access to vulnerable system.
The vulnerability exists due to an error within administrator.cfc. A remote unauthenticated attacker can access Adobe ColdFusion application using a default empty password, login to the RDS component and leverage this session to access administrative web interface.
Successful exploitation of this vulnerability results in unauthorized access to Adobe ColdFusion.
Note: the vulnerability was being actively exploited.The vulnerability was used to compromise website of the Washington state Administrative Office of the Courts (AOC).
Software: ColdFusion
Links:
http://www.adobe.com/support/security/advisories/apsa13-01.html
http://www.adobe.com/support/security/bulletins/apsb13-03.html
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27201
https://www.acunetix.com/vulnerabilities/web/adobe-coldfusion-9-administrative-login-bypass
https://vulners.com/metasploit/MSF:EXPLOIT/MULTI/HTTP/COLDFUSION_RDS
http://www.livehacking.com/category/vulnerability/adobe/
http://www.pcworld.com/article/2025406/adobe-patches-actively-exploited-coldfusion-vulnerabilities.h...
http://www.carehart.org/blog/client/index.cfm/2013/1/2/Part2_serious_security_threat
https://www.scmagazine.com/weakness-in-adobe-coldfusion-allowed-court-hackers-access-to-160k-ssns/ar...
http://www.itnews.com.au/news/a-million-drivers-licenses-possibly-stolen-via-coldfusion-hole-342953
http://krebsonsecurity.com/tag/amcrin/
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.This vulnerability was described by Eric Romang and FireEye through Malware Protection Cloud.
The vulnerability has been exploited in watering hole attacks against Council on Foreign Relations (CFR) website 26.12.2012. The attack appears to be closely related to attacks in June 2012 that were targeting visitors of a major hotel chain and other attacks associated with the Elderwood Project.
Software: Microsoft Internet Explorer
Links:
https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-det...
https://technet.microsoft.com/library/security/ms13-008
https://technet.microsoft.com/library/security/2794220
http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-...
https://blogs.technet.microsoft.com/srd/2012/12/31/microsoft-fix-it-available-for-internet-explorer-...
https://blogs.technet.microsoft.com/srd/2012/12/29/new-vulnerability-affecting-internet-explorer-8-u...
https://www.alienvault.com/blogs/labs-research/new-internet-explorer-zeroday-was-used-in-the-dol-wat...
http://blog.exodusintel.com/2013/01/04/bypassing-microsofts-internet-explorer-0day-fix-it-patch-for-...
https://nakedsecurity.sophos.com/2012/12/31/zero-day-vulnerability-in-internet-explorer-being-used-i...
Improper input validation
The vulnerability allows a remote attacker to perform phishing attacks.Software: Opera
Arbitrary file upload
The vulnerability allows a remote attacker to cause arbitrary code execution on the original server.The vulnerability was reported by ThaiCERT as a zero-day targeting websites across the country.
Software: Atomymaxsite
Cross-site scripting
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks and gain elevated privileges.Software: Microsoft Office InfoPath
Links:
https://technet.microsoft.com/en-us/library/security/ms12-066.aspx
http://www.mcafee.com/us/resources/release-notes/foundstone/fsl_10_10_2012.pdf
http://www.securityweek.com/recently-patched-html-sanitization-flaw-linked-hotmail-xss-vulnerability
http://www.trendmicro.com.ru/vinfo/ru/threat-encyclopedia/vulnerability/2293/microsoft-windows-html-...
http://www.tripwire.com/vert/vert-alert/vert-alert-october-9-2012/
https://www.sophos.com/en-us/threat-center/threat-analyses/vulnerabilities/VET-000380.aspx
Use-after-free error
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was found exploited in the wild and discovered by Eric Romang.
A real-world attack using the vulnerability first appeared in a blog post in Sep.14, 2012. The vulnerability was used by "Nitro" hacking group.
Software: Microsoft Internet Explorer
Links:
https://technet.microsoft.com/library/security/2757760
https://technet.microsoft.com/en-us/library/security/ms12-063
https://blogs.technet.microsoft.com/mmpc/2012/09/21/what-you-need-to-know-about-cve-2012-4969/
http://www.sevenforums.com/system-security/260613-should-i-remove-cve-2012-4969-a.html
http://krebsonsecurity.com/tag/cve-2012-4969/
https://www.f-secure.com/en/web/labs_global/cve-2012-4969
https://barracudalabs.com/2012/09/internet-explorer-0day-exploit-cve20124969-its-what-you-cant-see-t...
http://security.stackexchange.com/questions/21237/need-help-on-understanding-obfuscated-code-in-cve-...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=25947
http://contagiodump.blogspot.com/2012/09/cve-2012-4969-internet-explorer-0day.html
http://www.antiy.net/p/sample-of-cve-2012-4969/
https://www.securestate.com/blog/2012/09/21/threat-alert-internet-explorer-zero-day-cve-2012-4969
https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2012-4969-and-the-Unnamed-Admin-Panel/
Error Handling
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The researchers of FireEye began investigation of the vulnerability after Twitter post made by Joshua J. Drake on August, 26.
Software: Java SE
Links:
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
http://rhn.redhat.com/errata/RHSA-2012-1225.html
https://www.fireeye.com/blog/threat-research/2012/08/java-zero-day-first-outbreak.html
https://www.fireeye.com/blog/threat-research/2012/08/zero-day-season-is-not-over-yet.html
https://www.alienvault.com/blogs/labs-research/new-year-new-java-zeroday
https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-jav...
https://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.Favorite hackers' vulnerability for years has been exploited along with CVE-2012-1856, CVE-2015-1641, CVE-2015-1770 in an APT campaign against journalists and human rights workers in Tibet, Hong Kong and Taiwan.
Software: Microsoft Office
Links:
https://technet.microsoft.com/en-us/library/security/ms12-060
https://blog.ropchain.com/2015/07/27/analyzing-vupens-cve-2012-1856/
http://www.securityweek.com/cve-2012-0158-exploited-attacks-targeting-government-agencies-europe-asi...
http://researchcenter.paloaltonetworks.com/2015/08/rtf-exploit-installs-italian-rat-uwarrior/
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=25966
https://securelist.com/analysis/publications/37158/the-curious-case-of-a-cve-2012-0158-exploit/
https://threatpost.com/apt-targeting-tibetans-packs-four-vulnerabilities-in-one-compromise/117493/
https://www.hackread.com/skype-malware-saves-screenshots-records-conversations/
https://www.grahamcluley.com/advanced-malware-logs-skype-calls-steals-files-removable-drives/
https://securingtomorrow.mcafee.com/mcafee-labs/threat-actors-use-encrypted-office-binary-format-eva...
https://www.symantec.com/security_response/vulnerability.jsp?bid=54948
https://blogs.technet.microsoft.com/srd/2012/08/14/ms12-060-addressing-a-vulnerability-in-mscomctl-o...
http://varzia.com/blog/keyboy-malware-used-in-targeted-attacks-in-asia/
Memory corruption
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The vulnerability was reported by Alexander Gavrun. The exploit was used by Aurora Group.
Software: Adobe Flash Player
Known/fameous malware:
Exploit:SWF/CVE-2012-1535.A.
Links:
https://lists.opensuse.org/opensuse-security-announce/2012-08/msg00010.html
http://www.adobe.com/support/security/bulletins/apsb12-18.html
https://blogs.technet.microsoft.com/mmpc/2012/08/28/a-technical-analysis-on-cve-2012-1535-adobe-flas...
https://www.symantec.com/connect/blogs/cve-2012-1535-adobe-flash-player-vulnerability-exploited-mult...
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=25878
https://www.f-secure.com/en/web/labs_global/cve-2012-1535
http://contagiodump.blogspot.co.uk/2012/08/cve-2012-1535-samples-and-info.html
https://securingtomorrow.mcafee.com/mcafee-labs/adobe-flash-update-counters-cve-2012-1535/
http://blog.talosintel.com/2012/08/cve-2012-1535-flash-0-day-in-wild.html
http://www.digital4rensics.com/blog/2012/08/brief-osint-review-for-cve-2012-1535-attacks/
https://www.alienvault.com/blogs/labs-research/cve-2012-1535-adobe-flash-being-exploited-in-the-wild
http://www.ehackingnews.com/2012/08/cve-2012-1535-adobe-flash-player-exploit.html