Zero-day vulnerability in Microsoft Internet Explorer
Use-after-free
CVE-2010-0249
Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.
Vulnerability details
Advisory: SB2010011401 - Remote code execution in Microsoft Internet Explorer
Vulnerable component: Microsoft Internet Explorer
CVE-ID: CVE-2010-0249
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-416 - Use After Free
Description:
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use-after-free error in Microsoft Internet Explorer. A remote attacker can execute arbitrary code by accessing a pointer associated with a deleted object.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
Known APT campaigns:
Operation Aurora
Operation Aurora is a series of cyber attacks conducted since mid-2009. Such name was given by Dmitri Alperovitch of McAfee.
The operation was discovered by Google in January, 2010 and is considered to have Chinese origin.
The hackers targeted not only Google but also Yahoo, Symantec, Juniper Networks, Adobe, Northrop Grumman ╨╕ Dow Chemical.
Symantec identified the group behind the operation "Elderwood", Dell Secureworks - "Beijing Group".Public Exploits:
- Microsoft Internet Explorer - 'Aurora' Memory Corruption (MS10-002) (Metasploit) [Exploit-DB]
- Microsoft Internet Explorer 6 - Aurora Exploit [Exploit-DB]
External links:
https://blogs.technet.microsoft.com/msrc/2010/01/14/security-advisory-979352-released/
https://technet.microsoft.com/library/security/979352
https://technet.microsoft.com/en-us/library/security/ms10-002.aspx
http://www.computerworld.com/article/2522723/government-it/microsoft-to-patch-bug-used-in-google-hac...
http://www.theregister.co.uk/2010/01/15/ie_zero_day_exploit_goes_wild/
https://www.cnet.com/news/new-ie-hole-exploited-in-attacks-on-u-s-firms/
https://www.zscaler.com/blogs/research/ie-0-day-govcn
https://www.nsslabs.com/blog/protecting-vulnerability-cve-2010-0249/
https://www.zscaler.com/blogs/research/aurora-exploit-still-floating
http://www.geoffchappell.com/notes/security/aurora/
https://googleblog.blogspot.com/2010/01/new-approach-to-china.html
http://indiatoday.intoday.in/story/Chinese+hackers+target+PMO/1/79215.html
https://www.wired.com/2010/01/operation-aurora/
http://developers-club.com/posts/81142/
https://blog.fortinet.com/2010/01/21/ms10-002-get-it-while-it-s-hot