Zero-day vulnerability in Microsoft Internet Explorer

The vulnerability is declared as functional and was handled as a non-public zero-day exploit for at least 3274 days. The story of CVE-2010-0806 bears a certain similarity to the developments in the case of the targeted 'Aurora' attack where the exploit techniques were quickly adopted by the authors of web exploit kits for the use in massive web attacks. The country that suffered a huge loss by malware in April 2010 was China, with 22% of malware attacks. It was followed by Russia (17%), USA (10%), India (4%) and Germany (4%).

Advisory: SB2010030904 - Remote code execution in Microsoft Internet Explorer

Vulnerable component: Microsoft Internet Explorer

CVE-ID: CVE-2010-0806

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-416 - Use After Free

Description:

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in the Peer Objects component within iepeers.dll library. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Operation Aurora

Operation Aurora is a series of cyber attacks conducted since mid-2009. Such name was given by Dmitri Alperovitch of McAfee.

The operation was discovered by Google in January, 2010 and is considered to have Chinese origin.

The hackers targeted not only Google but also Yahoo, Symantec, Juniper Networks, Adobe, Northrop Grumman и Dow Chemical.

Symantec identified the group behind the operation "Elderwood", Dell Secureworks - "Beijing Group".

Sykipot campaigns

Sykipot attacks trace back to 2006.

The attackers were sending emails with specially crafted links or content containing JS.Sykipot and Backdoor.Sykipot. Trojans to obtain intellectual property (design, financial, manufacturing, or strategic planning information).

According to Symantec, the Sykipot group has Chinese roots.

- Microsoft Internet Explorer - DHTML Behaviour Use-After-Free (MS10-018) (Metasploit) [Exploit-DB]

- Microsoft Internet Explorer - 'iepeers.dll' Use-After-Free Exploit (Metasploit) [Exploit-DB]

External links:

https://blogs.technet.microsoft.com/msrc/2010/03/09/security-advisory-981374-released/
https://blogs.technet.microsoft.com/mmpc/2010/03/30/active-exploitation-of-cve-2010-0806/
http://blog.trendmicro.com/trendlabs-security-intelligence/new-ie-zero-day-exploit-cve-2010-0806/
https://www.zscaler.com/blogs/research/cve-2010-0806-exploit-wild
https://securingtomorrow.mcafee.com/mcafee-labs/targeted-internet-explorer-0day-attack-announced-cve...
https://vulners.com/metasploit/MSF:EXPLOIT/WINDOWS/BROWSER/MS10_018_IE_BEHAVIORS
http://techblog.omidfarhang.com/en-us/2010/04/09/singers-exploit-kit-version-cve-2010-0806/
https://blog.c22.cc/tag/cve-2010-0806/
http://www.spamfighter.com/News-14383-Kido-Still-Manages-to-be-the-Leading-Malware-Producer-in-April...