Zero-day vulnerability in Microsoft Internet Explorer

Use-after-free
CVE-2010-0249

Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.

Vulnerability details

Advisory: SB2010011401 - Remote code execution in Microsoft Internet Explorer

Vulnerable component: Microsoft Internet Explorer

CVE-ID: CVE-2010-0249

CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C

CWE-ID: CWE-416 - Use After Free

Description:

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in Microsoft Internet Explorer. A remote attacker can execute arbitrary code by accessing a pointer associated with a deleted object.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Known APT campaigns:

Operation Aurora

Operation Aurora is a series of cyber attacks conducted since mid-2009. Such name was given by Dmitri Alperovitch of McAfee.

The operation was discovered by Google in January, 2010 and is considered to have Chinese origin.

The hackers targeted not only Google but also Yahoo, Symantec, Juniper Networks, Adobe, Northrop Grumman ╨╕ Dow Chemical.

Symantec identified the group behind the operation "Elderwood", Dell Secureworks - "Beijing Group".

Public Exploits:

Vulnerability Scanning SaaS

Vulnerability scanning SaaS service is online 3-rd generation vulnerability scanner with scheduled assessments and vulnerability subscription. You can use service to check security of your network perimeter.