Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.
Advisory: SB2010011401 - Remote code execution in Microsoft Internet Explorer
Vulnerable component: Microsoft Internet Explorer
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-416 - Use After Free
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in Microsoft Internet Explorer. A remote attacker can execute arbitrary code by accessing a pointer associated with a deleted object.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
Known APT campaigns:
Operation Aurora is a series of cyber attacks conducted since mid-2009. Such name was given by Dmitri Alperovitch of McAfee.
The operation was discovered by Google in January, 2010 and is considered to have Chinese origin.
The hackers targeted not only Google but also Yahoo, Symantec, Juniper Networks, Adobe, Northrop Grumman ╨╕ Dow Chemical.Symantec identified the group behind the operation "Elderwood", Dell Secureworks - "Beijing Group".
- Microsoft Internet Explorer 6 - Aurora Exploit [Exploit-DB]
- Microsoft Internet Explorer - 'Aurora' Memory Corruption (MS10-002) (Metasploit) [Exploit-DB]