Zero-day Vulnerability Database

Change view:

Zero-day vulnerabilities discovered: 153

Multiple vulnerabilities in Microsoft Graphics Component
CVE-2016-7256

Memory Corruption

A remote attacker can execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of objects in memory in Windows font library when processing Open Type fonts. A remote attacker can create a specially crafted font file and cause memory corruption.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability started to appear on the radar in June 2016 as it was used in "low-volume attacks primarily focused on targets in South Korea". A successful attack exploited a flaw in the Windows font library to elevate privileges, and to install a backdoor on target systems called Hankray.

Software: Windows

Known/fameous malware:

Trojan Horse Exp.CVE-2016-7256.

The vulnerability started to appear on the radar in June 2016 as it was used in "low-volume attacks primarily focused on targets in South Korea". A successful attack exploited a flaw in the Windows font library to elevate privileges, and to install a backdoor on target systems called Hankray.

Privilege escalation in Windows 10
CVE-2016-7255

Privilege escalation

The vulnerability allows a local user to gain elevated privileges on the target system.

The weakness is due to improper handling of objects in memory by win32k.sys. By sending a specially crafted system call NtSetWindowLongPtr(), a local attacker can set index GWLP_ID to WS_CHILD value on a window handle with GWL_STYLE and execute arbitrary code with system privileges.

Successful explotation of the vulnerability results in privilege escalation.

Note: this vulnerability is being actively exploited in the wild.

i

The zero-day was being actively exploited by Russian hackers (APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, and Sofacy).

Software: Windows

The zero-day was being actively exploited by Russian hackers (APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, and Sofacy).

Remote code execution in Microsoft Office
CVE-2016-7193

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling of malicious RTF files by Microsoft Word. A remote attacker can create a specially crafted RTF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability will result in arbitrary code execution.

Note: the vulnerability was being actively exploited.

Software: Microsoft Word

Multiple vulnerabilities in Microsoft Edge
CVE-2016-7189

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into downloading it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability will result in arbitrary code execution.

Note: the vulnerability was being actively exploited.

Software: Microsoft Edge

Multiple vulnerabilities in Microsoft Windows
CVE-2016-3393

Arbitrary code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Graphics Device Interface (GDI) component. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been used by an APT group Kaspersky Lab call FruityArmor. Victims have been identified in Thailand, Iran, Algeria, Yemen, Saudi Arabia and Sweden.

Software: Windows

The vulnerability has been used by an APT group Kaspersky Lab call FruityArmor. Victims have been identified in Thailand, Iran, Algeria, Yemen, Saudi Arabia and Sweden.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2016-3298

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerablity exists due to improper handling of objects in memory by the Internet Messaging API. A remote attacker can create a specially crafted content, trick the victim into opening it, bypass security restrictions and determine the existence of arbitrary files.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Proofpoint researchers Will Metcalf and Kafeine first detected and reported CVE-2016-3298 in April 2016 as part of a “GooNky” infection chain along with CVE-2016-3351, but the information disclosure vulnerability was most likely already in use by the AdGholas group.

CVE-2016-3298 and CVE-2016-3351 were reported to Microsoft between October and December of 2015.


Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit Kit: Neutrino

Proofpoint researchers Will Metcalf and Kafeine first detected and reported CVE-2016-3298 in April 2016 as part of a “GooNky” infection chain along with CVE-2016-3351, but the information disclosure vulnerability was most likely already in use by the AdGholas group.

CVE-2016-3298 and CVE-2016-3351 were reported to Microsoft between October and December of 2015.


Multiple vulnerabilities in Microsoft Internet Explorer and Edge
CVE-2016-3351

Memory corruption

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to boundary error when handling of malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and gain access to arbitrary data.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Microsoft has known about CVE-2016-3351 since 2015.
Exploited By AdGholas and GooNky Malvertising Groups.

Software: Microsoft Internet Explorer

Microsoft has known about CVE-2016-3351 since 2015.
Exploited By AdGholas and GooNky Malvertising Groups.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2016-0189

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Used to target South Korean organizations.
A banking (Duuzer back door) trojan distributed by Sundown Exploit Kit (EK) to target South Korean organizations. Later it was included into Magnitude and KaiXin EKs.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit kit: Magnitude, Neutrino, RIG, Sundown.

Used to target South Korean organizations.
A banking (Duuzer back door) trojan distributed by Sundown Exploit Kit (EK) to target South Korean organizations. Later it was included into Magnitude and KaiXin EKs.

Multiple vulnerabilities in Microsoft Windows
CVE-2016-0165

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper handling of objects in memory by the kernel-mode driver. A local attacker can run a specially crafted program, gain elevated privileges and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The Badlock vulnerability.

Software: Windows

The Badlock vulnerability.

Multiple vulnerabilities in Microsoft Windows
CVE-2016-0167

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper handling of objects in memory by the kernel-mode driver. A local attacker can run a specially crafted program, gain elevated privileges and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Used to  compromise organizations in the USA and Canada. First attacks were detected in 08.03.2016.

Software: Windows

Known/fameous malware:

PUNCHBABY or PUNCHTRACK Trojan.

Used to  compromise organizations in the USA and Canada. First attacks were detected in 08.03.2016.

Remote code execution in Microsoft Silverlight
CVE-2016-0034

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when parsing strings with a malicious decoder that can return negative offsets. A remote attacker can create a specially crafted content, trick the victim into opening it, replace unsafe object headers with contents provided by an attacker and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

On July 5, 2015, a large amount of data from one company was leaked to the Internet with a hacker known as “Phineas Fisher” claiming responsibility for the breach.

Software: Microsoft Silverlight

Known/fameous malware:

Used in Angler, Hunter, RIG and Sundown Exploit Kit.

On July 5, 2015, a large amount of data from one company was leaked to the Internet with a hacker known as “Phineas Fisher” claiming responsibility for the breach.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-6175

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to boundary error when handling of objects in kernel memory. A local attacker can execute a specially crafted program, trigger memory corruption and gain SYSTEM privileges.

Successful exploitation of this vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Multiple vulnerabilities in Microsoft Office
CVE-2015-2545

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when parsing malformed images. A remote attacker can create a file containing a specially crafted image file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

CVE-2015-2545 fuels around 17% of attacks in Microsoft Office.

Used to target organisations in China.

Software: Microsoft Office

CVE-2015-2545 fuels around 17% of attacks in Microsoft Office.

Used to target organisations in China.

Remote code execution in Microsoft Windows Media Center
CVE-2015-2509

Arbitrary code execution

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper handling of Media Center link (.mcl) files. A remote attacker can create a specially crafted Media Center link (.mcl) file that references malicious code, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability results in system compromise.

Note: the vulnerability was being actively exploited.

i

This vulnerability is related to a previously unreported zero-day exploit discovered in the Hacking Team leaked emails. Trend Micro researchers (Aaron Luo, Kenney Lu, and Ziv Chang) discovered the exploit and subsequently reported their findings to Microsoft.

Software: Windows Media Center

This vulnerability is related to a previously unreported zero-day exploit discovered in the Hacking Team leaked emails. Trend Micro researchers (Aaron Luo, Kenney Lu, and Ziv Chang) discovered the exploit and subsequently reported their findings to Microsoft.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-2546

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to boundary error in ATMFD.dll in Win32k.sys. A local attacker can execute a specially crafted program, trigger memory corruption and gain SYSTEM privileges.

Successful exploitation of the vulnerability may result in full control of the vulnerable system.


Note: the vulnerability was being actively exploited.

i

The vulnerability was reported by FireEye researcher Wang Yu.

Software: Windows

The vulnerability was reported by FireEye researcher Wang Yu.

Remote code execution in Microsoft Internet Explorer
CVE-2015-2502

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling Javascript and HTML tables within the layout cache. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability has been exploited in watering hole attacks against compromised website belonging to an evangelical church in Hong Kong to deliver Korplug malware.

Software: Microsoft Internet Explorer

Known/fameous malware:

Korplug malware.

The vulnerability has been exploited in watering hole attacks against compromised website belonging to an evangelical church in Hong Kong to deliver Korplug malware.

Privilege escalation in Microsoft Windows
CVE-2015-1769

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper processing of symbolic links by Mount Manager. By inserting a specially crafted USB device into the system, an attacker can create arbitrary files and execute malicious code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Attackers used USB to infect computers with the malware at the Natanz uranium enrichment facility in Iran.
The .LNK vulnerability was also exploited by the Equation Group, uncovered by researchers at Kaspersky Lab.

Software: Windows

Known/fameous malware:

Fanny

Attackers used USB to infect computers with the malware at the Natanz uranium enrichment facility in Iran.
The .LNK vulnerability was also exploited by the Equation Group, uncovered by researchers at Kaspersky Lab.

Multiple vulnerabilities in Microsoft Office
CVE-2015-1642

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was discovered by Yong Chuan, Koh of MWR Labs.

Software: Microsoft Office

The vulnerability was discovered by Yong Chuan, Koh of MWR Labs.

Remote code execution in Microsoft Windows
CVE-2015-2426

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to buffer overflow in Windows Adobe Type Manager library when processing OpenType fonts. A remote attacker can create a specially crafted document or website with embedded malicious OpenType font, trick the victim into opening it, cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak.
The vulnerability was reported by FireEye's Genwei Jiang and Google Project Zero's Mateusz Jurczyk.

The vulnerability has being exploited by Eugene Ching of Qavar Security on the January 2015.

Software: Windows

The exploit code was revealed after Hacking Team data leak.
The vulnerability was reported by FireEye's Genwei Jiang and Google Project Zero's Mateusz Jurczyk.

The vulnerability has being exploited by Eugene Ching of Qavar Security on the January 2015.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2015-2425

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can create a specially crafted Web-site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak.

Software: Microsoft Internet Explorer

The exploit code was revealed after Hacking Team data leak.

Arbitrary code execution in Microsoft Windows
CVE-2015-2387

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to boundary error in the Adobe Type Manager module (ATMFD.dll). A local attacker can execute a specially crafted application, trigger memory corruption, bypass OS-level sandboxing and execute arbitrary code with SYSTEM privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The exploit code was revealed after Hacking Team data leak.
Public exploit code for this vulnerability became available as part of the Hacking Team leaks on July 5, 2015.

Software: Windows

The exploit code was revealed after Hacking Team data leak.
Public exploit code for this vulnerability became available as part of the Hacking Team leaks on July 5, 2015.

Remote code execution in Microsoft Office
CVE-2015-2424

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow when processing Office files. A remote attacker can create a specially crafted Office file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

The vulnerability reffers to the APT28 and Operation Pawn Storm and was used in cyber espionage campaign by Tsar Team.

Software: Microsoft Office

Known/fameous malware:

Trojan.Win32.Sofacy.

The vulnerability reffers to the APT28 and Operation Pawn Storm and was used in cyber espionage campaign by Tsar Team.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-2360

Memory corruption

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to boundary error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Expoited by Duqu 2.0 and used in attack against the Kaspersky Lab to hack their internal networks in early spring 2015.

Software: Windows

Expoited by Duqu 2.0 and used in attack against the Kaspersky Lab to hack their internal networks in early spring 2015.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-1701

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper access control. A local attacker can create a specially crafted application, execute a callback in userspace and use data from the System token to execute arbitrary code on the system with root privileges.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was combined with CVE-2015-3043 to perform Operation "Russian Doll".

Exploited by Russia’s APT28 (Fancy Bear APT) in cyber espionage campaign on the U.S defense contractors, European security companies and Eastern European government entities.

Software: Windows

The vulnerability was combined with CVE-2015-3043 to perform Operation "Russian Doll".

Exploited by Russia’s APT28 (Fancy Bear APT) in cyber espionage campaign on the U.S defense contractors, European security companies and Eastern European government entities.

Multiple vulnerabilities in Microsoft Office
CVE-2015-1641

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling rich text format files. A remote attacker can create a specially crafted RTF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability accounts for nearly 66% of attacks using Office Word.

APT attacks, targeting Tibetans, Uyghurs, human rights groups in Taiwan and Hong Kong, and journalists.

Software: Microsoft Office

The vulnerability accounts for nearly 66% of attacks using Office Word.

APT attacks, targeting Tibetans, Uyghurs, human rights groups in Taiwan and Hong Kong, and journalists.

Two remote code execution vulnerabilities in Microsoft Windows
CVE-2015-0096

Insecure dll. library loading

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Microsoft Windows parses shortcuts. A remote attacker can place a specially crafted .dll file along with an icon file on a remote SMB or WebDav share, trick the victim into opening that document and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.

i

According to Trustwave it is a zero-day.
Vulnerability CVE-2015-0096 is a continuation of CVE-2010-2568, which was believed to have been patched by MS10-046. However, it was not completely and we see this with MS15-018. At the time of the patch release there were fully functional exploits for this particular vulnerability.

Software: Windows

According to Trustwave it is a zero-day.
Vulnerability CVE-2015-0096 is a continuation of CVE-2010-2568, which was believed to have been patched by MS10-046. However, it was not completely and we see this with MS15-018. At the time of the patch release there were fully functional exploits for this particular vulnerability.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2015-0071

Security bypass

The vulnerabiity allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to failure to use Address Space Layout Randomization (ASLR). A remote attacker can create a specially crafted Web site, trick the victim into visiting it, bypass ASLR mechanism and predict memory locations that if connected with another vulnerability allows to execute arbitrary code.

Successful exploitation of this vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Allegedly, Chinese hackers combined it with a remote-code execution vulnerability in Adobe Flash to infect visitors to the Forbes website with malware since November, 2014.

Software: Microsoft Internet Explorer

Known/fameous malware:

JS:CVE-2015-0071-A.

Allegedly, Chinese hackers combined it with a remote-code execution vulnerability in Adobe Flash to infect visitors to the Forbes website with malware since November, 2014.

Cross-site scripting in Microsoft Internet Explorer
CVE-2015-0072

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input passed via vectors involving an IFRAME element. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user’s browser in context of another website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.
i

CVE-2015-0072 was apparently reported to Microsoft on Oct. 13, 2014, however David Leo disclosed the details of this vulnerability to the popular Full Disclosure security mailing list on Jan. 31, 2015.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit: HTML/CVE-2015-0072.A

CVE-2015-0072 was apparently reported to Microsoft on Oct. 13, 2014, however David Leo disclosed the details of this vulnerability to the popular Full Disclosure security mailing list on Jan. 31, 2015.

Privilege escalation in Microsoft Windows
CVE-2015-0016

Path traversal

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient validation of user-supplied input within TS WebProxy Windows component. A remote attacker can trick the victim into downloading a specially crafted file and execute it with privileges of the current user.  

Successful exploitation of the vulnerability may result in full control of the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was being used in CNACOM campaign targeting government organization in Taiwan.

Software: Windows

Known/fameous malware:

Exploit.Win32.CVE-2015-0016.

The vulnerability was being used in CNACOM campaign targeting government organization in Taiwan.

Privilege escalation in Microsoft Windows
CVE-2014-6324

Privilege escalation

The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly validate signatures in the Kerberos ticket by the Microsoft Kerberos KDC implementation. A remote attacker can forge a ticket and elevate an unprivileged domain user account to a domain administrator account.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Exploited by Duqu.

The vulnerability was reported by Qualcomm Information Security & Risk Management team.

Software: Windows

Exploited by Duqu.

The vulnerability was reported by Qualcomm Information Security & Risk Management team.

Privilege escalation in Microsoft Windows
CVE-2014-4077

Privilege escalation

The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.

The weakness exists due to improper access control in Microsoft implementation of Input Method Editor (IME) for Japanese language. A remote attacker can create a specially crafted file designed to invoke a vulnerable sandboxed application, trick the victim into opening it, gain elevated privileges and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

CVE-2014-4077 used in targeted attack in the wild to bypass Adobe Reader Sandbox via binary hijacking using malicious DIC file.

Software: Windows

CVE-2014-4077 used in targeted attack in the wild to bypass Adobe Reader Sandbox via binary hijacking using malicious DIC file.

Remote code execution in Microsoft Windows
CVE-2014-6352

Code injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when handling malicious Office files. A remote attacker can create a specially crafted Microsoft Office file containing the malicious OLE object, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Microsoft first received information about this vulnerability through coordinated vulnerability disclosure. Zero-day was initially found and reported to McAfee by James Forshaw of Google Project Zero.

The vulnerability is publicly known as "Sandworm" and has been exploited by the Chinese against Taiwan.

Software: Windows

Known/fameous malware:

Trojan.Mdropper. (Symantec).

Microsoft first received information about this vulnerability through coordinated vulnerability disclosure. Zero-day was initially found and reported to McAfee by James Forshaw of Google Project Zero.

The vulnerability is publicly known as "Sandworm" and has been exploited by the Chinese against Taiwan.

Remote code execution in Microsoft Windows
CVE-2014-4148

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper input validation when processing TrueType fonts in kernel-mode driver (win32k.sys). A remote attacker can create a specially crafted font file, place it on a web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was highly exploited by advanced adversary group named HURRICANE PANDA.

Software: Windows

The vulnerability was highly exploited by advanced adversary group named HURRICANE PANDA.

Remote code execution in Microsoft Windows
CVE-2014-4114

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when processing OLE objects. A remote attacker can create a specially crafted OLE object, attach it to a document (e.g. PowerPoint file), trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The zero-day vulnerability is being claimed to have been used in early September in possible campaigns against NATO, Ukrainian government organizations, Western European government organization, Energy Sector firms (specifically in Poland), European telecommunications firms, United States academic organizations.
Files in the SandWorm exploit hilighted by iSIGHT Partners include a malicious executable from a known malware family, namely the BlackEnergy Trojan.

Software: Windows

Known/fameous malware:

Dyreza Trojan.
SandWorm
BlackEnergy Trojan.

The zero-day vulnerability is being claimed to have been used in early September in possible campaigns against NATO, Ukrainian government organizations, Western European government organization, Energy Sector firms (specifically in Poland), European telecommunications firms, United States academic organizations.
Files in the SandWorm exploit hilighted by iSIGHT Partners include a malicious executable from a known malware family, namely the BlackEnergy Trojan.

Privilege escalation in Microsoft Windows
CVE-2014-4113

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper handling of objects in memory by kernel-mode driver (win32k.sys). A local attacker can run a specially crafted application to gain elevated privileges and take complete control of the system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was apparently found and reported to Microsoft by both СrowdStrike and FireEye.
The vulnerability has been actively exploited in the wild for at least five month by highly advanced adversary group named HURRICANE PANDA.

Software: Windows

Known/fameous malware:

Nuclear Exploit Kit.

The vulnerability was apparently found and reported to Microsoft by both СrowdStrike and FireEye.
The vulnerability has been actively exploited in the wild for at least five month by highly advanced adversary group named HURRICANE PANDA.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2014-4123

Privilege escalation

The vulnerability allows a remote attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly validate permissions. A remote attacker can gain elevated privileges and execute arbitrary code on the affected system.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

CrowdStrike first detected the attacks in spring.
The zero-day reported by CrowdStrike was also reported by FireEye.
The issue has been introduced in 07/27/2005.
The vulnerability was handled as a non-public zero-day exploit for at least 3366 days.

Exploited by Hurricane Panda.

Software: Microsoft Internet Explorer

CrowdStrike first detected the attacks in spring.
The zero-day reported by CrowdStrike was also reported by FireEye.
The issue has been introduced in 07/27/2005.
The vulnerability was handled as a non-public zero-day exploit for at least 3366 days.

Exploited by Hurricane Panda.

Information disclosure in Microsoft Internet Explorer
CVE-2013-7331

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to information disclosure vulnerability in Microsoft XMLDOM ActiveX component. A remote attacker can create a specially crafted Web page, trick the victim into visiting it and check for the presence of local drive letters, directory names, files, as well as internal network addresses or websites.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

PoC-code for this vulnerability was available since at least April 25, 2013.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit kits: Angler, Rig, Nuclear, Styx.

PoC-code for this vulnerability was available since at least April 25, 2013.

Privilege escalation in Microsoft Internet Explorer
CVE-2014-2817

Privelege escalation

The vulnerability allows a remote attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly validate permissions. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, gain elevated privileges and execute arbitrary code on the affected system.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Internet Explorer

Privilege escalation in Microsoft Windows
CVE-2014-1807

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper use of the ShellExecute API function. A local attacker can run a specially crafted application within the context of the Local System account and gain elevated privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Two remote code execution vulnerabilities in Microsoft Internet Explorer
CVE-2014-1815

“Use-after-free” error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

CVE-2014-1815 was reported to Microsoft by Clement Lecigne, a security engineer who works for Google in its Swiss office.

The vulnerability was used in the phishing campaign started on or about July 21, 2014 and primarily targeting the energy industry.

Software: Microsoft Internet Explorer

CVE-2014-1815 was reported to Microsoft by Clement Lecigne, a security engineer who works for Google in its Swiss office.

The vulnerability was used in the phishing campaign started on or about July 21, 2014 and primarily targeting the energy industry.

Privilege escalation in Microsoft Windows
CVE-2014-1812

Privilege escalation

The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.

The weakness exists due to the method passwords are distributed when configured using group policy preference. A remote authenticated attacker can obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Security bypass in Microsoft Office
CVE-2014-1809

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper implementation of Address Space Layout Randomization (ASLR) features in MSCOMCTL. By persuading a victim to visit a specially-crafted Web site or open an application or Office document with a specially-crafted ActiveX control embedded within it, an attacker could exploit this vulnerability to bypass ASLR and execute another attack that otherwise would have been blocked by ASLR.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The issue has been introduced in 01/30/2007.

Software: Microsoft Office

The issue has been introduced in 01/30/2007.

Remote code execution in Microsoft Internet Explorer
CVE-2014-1776

“Use-after-free” error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability uses a heap-spray technique. Used in Pawn Storm campaign.
Used by APT groups.

Software: Microsoft Internet Explorer

The vulnerability uses a heap-spray technique. Used in Pawn Storm campaign.
Used by APT groups.

Multiple vulnerabilities in Microsoft Word and Office Web Apps
CVE-2014-1761

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling RTF-formatted data. A remote attacker can create a specially crafted RTF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Used in Pawn Storm campaign, attacks against government agencies in Taiwan.

Software: Microsoft Office

Known/fameous malware:

Trojans like Dridex or Dyreza and ransomware like cryptolocker or Teslacrypt.

Used in Pawn Storm campaign, attacks against government agencies in Taiwan.

Remote code execution in Microsoft Internet Explorer
CVE-2014-0307

“Use-after-free” error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free when accessing an object in memory. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The flaw was most likely introduced in August 2013. The vulnerability was reported to vendor - 2014-02-04.
Private fully functional exploit code existed long before the vendor released security patch. We consider this vulnerability a zero-day.

Software: Microsoft Internet Explorer

Known/fameous malware:

JS/Exploit.CVE-2014-0307.

The flaw was most likely introduced in August 2013. The vulnerability was reported to vendor - 2014-02-04.
Private fully functional exploit code existed long before the vendor released security patch. We consider this vulnerability a zero-day.

Remote code execution in Microsoft Internet Explorer
CVE-2014-0324

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

On Feb. 11, FireEye researchers identified a zero-day exploit in Internet Explorer 10.

The exploit was being used in Operation SnowMan that compromised the U.S. Veterans of Foreign Wars website.


Software: Microsoft Internet Explorer

Known/fameous malware:

Elderwood exploit kit.

On Feb. 11, FireEye researchers identified a zero-day exploit in Internet Explorer 10.

The exploit was being used in Operation SnowMan that compromised the U.S. Veterans of Foreign Wars website.


Remote code execution in Microsoft Internet Explorer
CVE-2014-0322

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error related to GIFAS. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

A zero-day exploit hosted on a breached website based in the U.S Military. The vulnerability was used in the wild as part of "Operation SnowMan".

Software: Microsoft Internet Explorer

Known/fameous malware:

Trojan.Malscript
Trojan.Swifi.
Backdoor.Moudoor
Elderwood exploit kit.

A zero-day exploit hosted on a breached website based in the U.S Military. The vulnerability was used in the wild as part of "Operation SnowMan".

Multiple vulnerabilities in Microsoft .NET Framework
CVE-2014-0295

ASLR bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to missing Address Space Layout Randomization (ASLR) features in certain components. A remote attacker can create a specially crafted Web site, trick the victim into opening it, bypass security restrictions and execute another attack.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft .NET Framework

Information disclosure in Microsoft XML Core Services
CVE-2014-0266

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper enforcement of cross-domain policies. A remote attacker can create a specially crafted Web page, trick the victim into visiting it using Internet Explorer, bypass cross-domain security restrictions and read local files or content from web domains the victim is authenticated with.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Microsoft and FireEye first discussed this issue in November, 2013.

Software: Microsoft XML Core Services

Microsoft and FireEye first discussed this issue in November, 2013.

Information disclosure in Microsoft Office
CVE-2013-5054

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in handling of a specially crafted response when opening a malicious Office file. A remote attacker can create a specially crafted file using, host it on remote website, trick the victim into opening it and gain access to tokens used to authenticate the current user on a targeted SharePoint or other Microsoft Office server site.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by the Adallom company and the attack was dubbed "Ice Dagger". The attackers used the vulnerability to steal Microsoft Office 365 authentication token. The victim of the unnamed company received an email with a link to attachment, located on a hidden server within TOR network. The vulnerability was reported to Microsoft in late May 2013.

Software: Microsoft Office

The vulnerability was discovered by the Adallom company and the attack was dubbed "Ice Dagger". The attackers used the vulnerability to steal Microsoft Office 365 authentication token. The victim of the unnamed company received an email with a link to attachment, located on a hidden server within TOR network. The vulnerability was reported to Microsoft in late May 2013.

Signature validation bypass in Microsoft Windows
CVE-2013-3900

Sugnature verification bypass

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper validation of PE file digests during Authenticode signature verification within WinVerifyTrust function. A remote attacker can create specially crafted signed PE file, trick the victim into executing it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

ASLR bypass in Microsoft Office
CVE-2013-5057

ASLR bypass

The vulnerability allows a remote attacker to bypass certain security restrictions.

The weakness exists due to improper implementation of Address Space Layout Randomization (ASLR) within HXDS Office shared component. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and bypass the ASLR security feature.

Successful exploitation of the vulnerability may result in attacker's access to the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Office

Privilege escalation in Microsoft Windows
CVE-2013-5065

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper validation of input by the NDProxy.sys kernel component. A local attacker with valid login credentials can use a malicious application to gain kernel privileges and execute arbitrary code on the system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the Reader sandbox.

Kaspersky Lab revealed the vulnerability was used in Epic Turla (cyber-espionage campaigns).

Software: Windows

Known/fameous malware:

PDF:Exploit.CVE-2013-5065.A
Gen:Trojan.Heur.FU.ku3@aSHWAmji

Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the Reader sandbox.

Kaspersky Lab revealed the vulnerability was used in Epic Turla (cyber-espionage campaigns).

Remote code execution in Microsoft Windows
CVE-2013-3918

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to out-of-bounds memory access within InformationCardSigninHelper Class ActiveX control (icardie.dll). A remote attacker can create specially crafted Web page that passes an overly long string argument to vulnerable ActiveX component, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerabilty was introduced on 07.27.2005, but publically disclosed later by Xiaobo Chen and Dan Caselden of FireEye.
The vulnerability has been exploited by the APTgroup behind the 2009 Aurora attack. The exploit uses a technique ROP (return-oriented-programming). According to FireEye, the attack has a link to the infrastructure used in Operation DeputyDog and Operation Ephemeral Hydra, which began in August and targeted organizations in Japan.

Software: InformationCardSigninHelper Class ActiveX control

The vulnerabilty was introduced on 07.27.2005, but publically disclosed later by Xiaobo Chen and Dan Caselden of FireEye.
The vulnerability has been exploited by the APTgroup behind the 2009 Aurora attack. The exploit uses a technique ROP (return-oriented-programming). According to FireEye, the attack has a link to the infrastructure used in Operation DeputyDog and Operation Ephemeral Hydra, which began in August and targeted organizations in Japan.

Remote code execution in Microsoft Graphics Component
CVE-2013-3906

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious images. A remote attacker can create specially crafted TIFF image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The meta date of the files were set to October 17, 2013, which may suggest a creation time of this exploit.

Attacks leveraging this zero-day exploit revealed that the Hangover group, believed to operate from India, has compromised 78 computers, 47 percent of those in Pakistan. The attacks observed are very limited and carefully carried out against selected computers, largely in the Middle East and South Asia.

Software: Microsoft Office

The meta date of the files were set to October 17, 2013, which may suggest a creation time of this exploit.

Attacks leveraging this zero-day exploit revealed that the Hangover group, believed to operate from India, has compromised 78 computers, 47 percent of those in Pakistan. The attacks observed are very limited and carefully carried out against selected computers, largely in the Middle East and South Asia.

Remote code execution in Microsoft Internet Explorer
CVE-2013-3897

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to user-after-free vulnerability in the CDisplayPointer object. A remote attacker can create a specially crafted Web page containing, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Used in Pawn Storm campaign.
A zero-day was used in highly targeted, low-volume attacks in Korea, Hong Kong, and the United States, as early as September 18th, 2013.

Software: Microsoft Internet Explorer

Used in Pawn Storm campaign.
A zero-day was used in highly targeted, low-volume attacks in Korea, Hong Kong, and the United States, as early as September 18th, 2013.

Remote code execution in Microsoft Internet Explorer
CVE-2013-3893

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in SetMouseCapture implementation. A remote attacker can create specially crafted JavaScript, place it on a Web page, trick the victim into visiting it using Internet Explorer, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability used ROP-chain technique and was exploited in Campaign Operation DeputyDog.

The vulnerability was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well.

Software: Microsoft Internet Explorer

The vulnerability used ROP-chain technique and was exploited in Campaign Operation DeputyDog.

The vulnerability was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well.

Remote code execution in Microsoft Internet Explorer
CVE-2013-3163

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in CBlockContainerBlock. A remote attacker can create specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability reffers to "Waterring hole attack".

Software: Microsoft Internet Explorer

The vulnerability reffers to "Waterring hole attack".

Remote code execution in Microsoft Office
CVE-2013-1331

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when processing malicious PNG files. A remote attacker can create specially crafted file, trick the victim into opening it using an affected version of Microsoft Office, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Andrew Lyons and Neel Mehta of Google Inc.

Using the samples provided by Microsoft, Romang scoured Google’s cache and found the earliest document that attempted to fetch the exploit dated from February, 2013. The document referenced territory disputes between China and the Philippines.
However, Romang uncovered another Word document created in 2009 that, according to Google’s Virus Total service, would also exploit the flaw Microsoft patched. The file’s title “The corruption of Mahathir” referred to a Malaysian politician, fitting Microsoft’s list of possible targets. Both documents to a Bridging Links URL.

The vulnerability might have been spotted in the wild, with campaigns starting as early as 2009. Microsoft believe attacks were limited to Indonesia and Malaysia.

Software: Microsoft Office

Known/fameous malware:

Trojan.Mdropper.

The vulnerability was reported by Andrew Lyons and Neel Mehta of Google Inc.

Using the samples provided by Microsoft, Romang scoured Google’s cache and found the earliest document that attempted to fetch the exploit dated from February, 2013. The document referenced territory disputes between China and the Philippines.
However, Romang uncovered another Word document created in 2009 that, according to Google’s Virus Total service, would also exploit the flaw Microsoft patched. The file’s title “The corruption of Mahathir” referred to a Malaysian politician, fitting Microsoft’s list of possible targets. Both documents to a Bridging Links URL.

The vulnerability might have been spotted in the wild, with campaigns starting as early as 2009. Microsoft believe attacks were limited to Indonesia and Malaysia.

Privilege escalation in Microsoft Windows
CVE-2013-3660

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly initialize a pointer for the next object in a certain list by the EPATHOBJ::pprFlattenRec function within kernel-mode driver (win32k.sys). A local attacker can use multiple FlattenPath function calls to obtain write access to the PATHRECORD chain and execute arbitrary code on the system with elevated privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Tavis Ormandy, a Google security engineer, reported a critical bug to Microsoft only five days before going public.
The vulnerability has being used by Carbanak group.

Software: Windows

Known/fameous malware:

Cidox/Rovnix Bootkit
PowerLoader

Tavis Ormandy, a Google security engineer, reported a critical bug to Microsoft only five days before going public.
The vulnerability has being used by Carbanak group.

Remote code execution in Microsoft Internet Explorer
CVE-2013-1347

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the CGenericElement object. A remote attacker can create specially crafted Web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been exploited in watering hole attack against Department of Labor (DoL). Used in Pawn Storm campaign.

Software: Microsoft Internet Explorer

The vulnerability has been exploited in watering hole attack against Department of Labor (DoL). Used in Pawn Storm campaign.

Cross-site scripting in Microsoft SharePoint Server
CVE-2013-1289

Cross-site scripting

The vulnerability allows a remote attacker to obtain elevated privileges on the target system.

The weakness exists due to an error related to the way HTML strings are sanitized by HTML Sanitization components. A remote attacker can create a specially crafted URL, trick the victim into opening it, take actions on the targeted site or read restricted content and obtain sensitive information with elevated privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft SharePoint Server

Remote code execution in Microsoft Silverlight
CVE-2013-0074

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when rendering an HTML object. A remote attacker can create a specially crafted Web site containing a malicious Silverlight applicationt, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Silverlight

Known/fameous malware:

Exploit kits: Angler, Archie, Astrum, Fiesta, Hanjuan, Infinity (Exploit kit), Neutrino, Nuclear Pack, RIG.

Remote code execution in Microsoft Internet Explorer
CVE-2012-4792

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when handling the CDwnBindInfo object and attempting to access an object in memory that has not been initialized or has been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was described by Eric Romang and FireEye through Malware Protection Cloud.

The vulnerability has been exploited in watering hole attacks against Council on Foreign Relations (CFR) website 26.12.2012. The attack appears to be closely related to attacks in June 2012 that were targeting visitors of a major hotel chain and other attacks associated with the Elderwood Project.

Software: Microsoft Internet Explorer

This vulnerability was described by Eric Romang and FireEye through Malware Protection Cloud.

The vulnerability has been exploited in watering hole attacks against Council on Foreign Relations (CFR) website 26.12.2012. The attack appears to be closely related to attacks in June 2012 that were targeting visitors of a major hotel chain and other attacks associated with the Elderwood Project.

XSS in HTML Sanitization Component in Microsoft Office products
CVE-2012-2520

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks and gain elevated privileges.

The vulnerability exists due to insufficient sanitization of user-input within HTML Sanitization Component. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user’s browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.

Software: Microsoft Office InfoPath

Remote code execution in Microsoft Internet Explorer
CVE-2012-4969

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the CMshtmlEd::Exec function in mshtml.dll. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was found exploited in the wild and discovered by Eric Romang.

A real-world attack using the vulnerability first appeared in a blog post in Sep.14, 2012. The vulnerability was used by "Nitro" hacking group.

Software: Microsoft Internet Explorer

The vulnerability was found exploited in the wild and discovered by Eric Romang.

A real-world attack using the vulnerability first appeared in a blog post in Sep.14, 2012. The vulnerability was used by "Nitro" hacking group.

Remote code execution in Windows Common Controls
CVE-2012-1856

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in MSCOMCTL.OCX ActiveX control. A remote attacker can create a specially crafted Web page that passes an overly long string argument, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Favorite hackers' vulnerability for years has been exploited along with CVE-2012-1856, CVE-2015-1641, CVE-2015-1770 in an APT campaign against journalists and human rights workers in Tibet, Hong Kong and Taiwan.


Software: Microsoft Office

Favorite hackers' vulnerability for years has been exploited along with CVE-2012-1856, CVE-2015-1641, CVE-2015-1770 in an APT campaign against journalists and human rights workers in Tibet, Hong Kong and Taiwan.


Remote code execution in Microsoft Office
CVE-2012-1854

Untrusted Search Path

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Microsoft Office loads .dll libraries when opening Office documents (such as a .docx file). A remote attacker can place a specially crafted .dll file along with Microsoft Office document on a remote SMB or WebDAV share, trick the victim into opening that document and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was being actively exploited since mid-March, 2012. The targeted attacks were focusing on Japanese organizations.

Software: Microsoft Office

The vulnerability was being actively exploited since mid-March, 2012. The targeted attacks were focusing on Japanese organizations.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2012-1875

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a use-after-free error related to same id property when attempting to access objects that have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

A functional exploit with shellcode appeared on PasteBin on 8.06.12 - four days before the Microsoft patch release.
The vulnerability was reported by adept with nickname Dark Son and researcher Yichong Lin.

Software: Microsoft Internet Explorer

Known/fameous malware:

Trojan.Naid.

A functional exploit with shellcode appeared on PasteBin on 8.06.12 - four days before the Microsoft patch release.
The vulnerability was reported by adept with nickname Dark Son and researcher Yichong Lin.

Remote code execution in Microsoft XML Core Services
CVE-2012-1889

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in XML Core Services (MSXML) when attempting to access an object in memory that has not been initialized. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

One of the vulnerabilities used by Aurora group.

The attackers used the CVE-2010-2884 and CVE-2012-1889 0-day exploits to specifically target visitors to Amnesty International Hong Kong site

 20.06.2012 SophosLabs determined that the website of a European aeronautical parts supplier had been hacked and delivered exploit for CVE-2012-1889.

TrendMicro observed the vulnerability targeting Chinese high school webpage.

Software: Microsoft XML Core Services

One of the vulnerabilities used by Aurora group.

The attackers used the CVE-2010-2884 and CVE-2012-1889 0-day exploits to specifically target visitors to Amnesty International Hong Kong site

 20.06.2012 SophosLabs determined that the website of a European aeronautical parts supplier had been hacked and delivered exploit for CVE-2012-1889.

TrendMicro observed the vulnerability targeting Chinese high school webpage.

Remote code execution in MSCOMCTL.OCX ActiveX control in Microsoft Office
CVE-2012-0158

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in MSCOMCTL.OCX ActiveX control. A remote attacker can create a specially crafted Web page that passes an overly long string argument, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Researchers based in Asia noticed these malicious documents in Japan and Taiwan before they started showing up/targeting USA companies.

The vulnerability appeared to operate in 2014 in the Western Australian time zone. Examples of such groups include the 'Shiqiang Gang' (as reported by McAfee), 'PLEAD' (as reported by Trend Micro), 'NetTraveler' (as reported by Kaspersky) and 'APT12' (as reported by FireEye).

The vulnerability has been exploited in Red October attacks in 2012 and attacks targeting Chinese media organizations, personnel at government agencies in Europe, Middle East and Central Asia in 2013. The exploit was successfully used in breach attack against NewYork Times in August of 2013. The vulnerability was still exploited in 2016. Exploit for this vulnerability was used in Pawn Storm campaign as well.

Software: Microsoft Office

Known/fameous malware:

TROJ_DROPPER.IK
BKDR_HGDER.IK.

Researchers based in Asia noticed these malicious documents in Japan and Taiwan before they started showing up/targeting USA companies.

The vulnerability appeared to operate in 2014 in the Western Australian time zone. Examples of such groups include the 'Shiqiang Gang' (as reported by McAfee), 'PLEAD' (as reported by Trend Micro), 'NetTraveler' (as reported by Kaspersky) and 'APT12' (as reported by FireEye).

The vulnerability has been exploited in Red October attacks in 2012 and attacks targeting Chinese media organizations, personnel at government agencies in Europe, Middle East and Central Asia in 2013. The exploit was successfully used in breach attack against NewYork Times in August of 2013. The vulnerability was still exploited in 2016. Exploit for this vulnerability was used in Pawn Storm campaign as well.

Remote code execution in Microsoft Windows
CVE-2011-3402

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers. A remote attacker can create a specially crafted Word document or web page containing font data, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was being actively exploited by the Stuxnet in Duqu attack.

Software: Windows

Known/fameous malware:

Win32/Exploit.CVE-2011-3402.G
W32.Duqu

This vulnerability was being actively exploited by the Stuxnet in Duqu attack.

Denial of service in Microsoft RDP
CVE-2011-1968

Denial of service

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to an error in the Remote Desktop Protocol when processing a sequence of malicious packets. A remote attacker can send a specially crafted RDP packets, gain access to an object that was not properly initialized or is deleted and cause the system to stop responding and restart.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2011-1255

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error related to time element when Internet Explorer attempts to access objects that have not been correctly initialized or have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: According to experts from M86, the vulnerability was exploited in targeted attacks before the official patch release from Microsoft.
i

According to experts from M86, this vulnerability was exploited in targeted attacks before the official patch release from Microsoft.

Software: Microsoft Internet Explorer

According to experts from M86, this vulnerability was exploited in targeted attacks before the official patch release from Microsoft.

Privilege escalation in Microsoft Windows
CVE-2011-1249

Privilege escalation

The vulnerability allows a local user to gain elevated privileges on the target system.

The vulnerability exists due to improper validation of input passed from user mode to the kernel in the Ancillary Function Driver (afd.sys). By running a malicious application, a local attacker with valid login credentials can execute arbitrary code with system privileges.

Successful exploitation of this vulnerability will allow the local attacker to obtain elevated privileges on vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Multiple vulnerabilities in Microsoft Windows
CVE-2012-0181

Improper input validation

The vulnerability allows a local user to obtain elevated privileges on the target system.

The vulnerability exists due to improper managing of Keyboard Layout files by the kernel-mode driver (win32k.sys). A local attacker can execute arbitrary code on vulnerable system with SYSTEM privileges.

Successful exploitation of this vulnerability will allow the local attacker to obtain elevated privileges on vulnerable system.

Note: the vulnerability was being actively exploited.

i

According to Trustwave this is a zero-day.
A private exploit has been developed by Cr4sh and been published 2 weeks after the advisory.

CVE-2012-0181 fixes an issue alluded to on exploitdb site on Nov. 21, 2011, fixed July 10, 2012.

Software: Windows

According to Trustwave this is a zero-day.
A private exploit has been developed by Cr4sh and been published 2 weeks after the advisory.

CVE-2012-0181 fixes an issue alluded to on exploitdb site on Nov. 21, 2011, fixed July 10, 2012.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2011-0094

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when handling layout objects that have not been correctly initialized or have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was reported to iDefense by anonymous. NSS was ready to pay for exploit for this vulnerability $100-500.

The vulnerability was used to compromise Philippines human rights website.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit:Win32/CVE-2011-0094.A

This vulnerability was reported to iDefense by anonymous. NSS was ready to pay for exploit for this vulnerability $100-500.

The vulnerability was used to compromise Philippines human rights website.

Information disclosure in MHTML in Microsoft Windows
CVE-2011-0096

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input passed via MIME-formatted requests for content blocks within a document. A remote attacker can trick the victim to follow a specially crafted "MHTML:" link and execute arbitrary HTML and script code in user’s browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


i

The vulnerability was originally disclosed on the WooYun website.

Software: Windows

Known/fameous malware:

exploit:win32/cve-2011-0096 trojan horse.

The vulnerability was originally disclosed on the WooYun website.

Remote code execution in Microsoft Internet Explorer
CVE-2011-1345

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling onPropertyChange function calls. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was firstly disclosed by VUPEN in January 22, 2011.

This issue was disclosed as part of the Pwn2Own 2011 contest.
Using this vulnerability Irish security researcher Stephen Fewer successfully hacked into a 64-bit Windows 7 (SP1) running Internet Explorer 8 to win CanSecWest hacker challenge ($15,000 cash prize and a new Windows laptop) in March 9-11 in Vancouver, British Columbia.

The issue has been introduced in 03/05/2008.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit:JS/CVE-2011-1345.

The vulnerability was firstly disclosed by VUPEN in January 22, 2011.

This issue was disclosed as part of the Pwn2Own 2011 contest.
Using this vulnerability Irish security researcher Stephen Fewer successfully hacked into a 64-bit Windows 7 (SP1) running Internet Explorer 8 to win CanSecWest hacker challenge ($15,000 cash prize and a new Windows laptop) in March 9-11 in Vancouver, British Columbia.

The issue has been introduced in 03/05/2008.

Remote code execution in Microsoft Internet Explorer
CVE-2010-3971

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when parsing CSS styles. A remote attacker can create a specially crafted web page containing Cascading Style Sheet that refers to itself recursively, cause memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability appears to be connected to the group of Chinese hackers responsible for unleashing a pair of Java zero-day exploits in 2012. After examining of the geographical location of the targets for CVE-2010-3971, these attack attempts bear a close resemblance to those targeting CVE-2010-3962, another Internet Explorer issue that was dubbed as the Weekend Warrior.

Software: Microsoft Internet Explorer

Known/fameous malware:

Virus HTML:CVE-2010-3971-A

The vulnerability appears to be connected to the group of Chinese hackers responsible for unleashing a pair of Java zero-day exploits in 2012. After examining of the geographical location of the targets for CVE-2010-3971, these attack attempts bear a close resemblance to those targeting CVE-2010-3962, another Internet Explorer issue that was dubbed as the Weekend Warrior.

Privilege escalation in Windows Task Scheduler
CVE-2010-3338

Privilege escalation

The vulnerability allows a local user obtain elevated privileges on vulnerable system.

The vulnerability exists in Windows Task Scheduler when running scheduled tasks within the intended security context. A local user can create a specially crafted task and execute arbitrary code on vulnerable system with privileges of the local system account.

Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was used by Stuxnet.

Software: Windows

Known/fameous malware:

W32.Stuxnet TDL-4 rootkit (TDSS) Trojan.Generic.KDV.128306

The vulnerability was used by Stuxnet.

Use-after-free when parsing CSS in Internet Explorer
CVE-2010-3962

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when processing CSS token sequences and the clip attribute. A remote attacker can create a specially crafted HTML page, trick the victim into visiting it, cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability refers to cyberattacks, linked to the Nobel Peace Prize ceremony and G20-related malicious spam campaign reported in October 2010.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit: Win32/CVE-2010-3962.A.

The vulnerability refers to cyberattacks, linked to the Nobel Peace Prize ceremony and G20-related malicious spam campaign reported in October 2010.

Multiple privilege escalation vulnerabilities in Win32k.sys in Microsoft Windows
CVE-2010-2743

Improper validation of array index

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to an error in Win32k.sys driver when handling keyboard layouts as the Windows kernel fails to validate that an array index is within the bounds of the array. A local user can load a specially crafted keyboard layout and execute arbitrary code on the target system with privileges of SYSTEM account.

Successful exploitation of this vulnerability may allow an attacker to escalate privileges on vulnerable system.

Note: this vulnerability is being actively exploited by Stuxnet.
i

The vulnerability was discovered by Sergey Golovanov from Kaspersky Lab. The vulnerability was exploited by Stuxnet.

Software: Windows

Known/fameous malware:

W32.Stuxnet

The vulnerability was discovered by Sergey Golovanov from Kaspersky Lab. The vulnerability was exploited by Stuxnet.

Information disclosure in ASP.NET
CVE-2010-3332

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to improper handling of errors during encryption padding verification. A remote attacker can gain access to potentially sensitive encrypted information, such as view state, read files and possibly forge cookies.

Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information and potentially compromise vulnerable web application.

Note: this vulnerability is being publicly exploited.

Software: Microsoft .NET Framework

Remote code execution in Print Spooler service in Microsoft Windows
CVE-2010-2729

Improper access control

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Windows Print Spooler service does not correctly restricts access permissions to create files for anonymous users. A remote attacker can send specially crafted RPC request to vulnerable service and upload malicious file to arbitrary location on the system.

This is a remote code execution vulnerability on Windows XP, since the guest account is enabled by default. On other operating systems this is a privilege escalation vulnerability, as only authenticated users have access to Print Spooler shares.

Successful exploitation of the vulnerability may result in remote code execution.

Note: this vulnerability is being actively exploited.

i

Two more CVEs refer to this vulnerability as well: CVE-2010-3888 and CVE-2010-3889. However since the vendor has issued advisory with different CVE number, we will use the one issued by Microsoft.

The vulnerability has been exploited in “print-bomb” attack as Stuxnet worm.

Software: Windows

Two more CVEs refer to this vulnerability as well: CVE-2010-3888 and CVE-2010-3889. However since the vendor has issued advisory with different CVE number, we will use the one issued by Microsoft.

The vulnerability has been exploited in “print-bomb” attack as Stuxnet worm.

Remote code execution in Microsoft Windows
CVE-2010-2568

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing icons to .lnk and .pif files within Windows Explorer. A remote attacker can create a specially crafted icon file, trick the victim into clicking on it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was used by Stuxnet worm. According to Symantec the first exploitation of the vulnerability was discovered on 2008-02-13.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.343
W32.Stuxnet
W32.Changeup.C
W32.Ramnit

The vulnerability was used by Stuxnet worm. According to Symantec the first exploitation of the vulnerability was discovered on 2008-02-13.

Remote code execution when parsing URLs in Microsoft Windows
CVE-2010-1885

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing URLs within Microsoft Help and Support Center. A remote attacker can create a specially crafted hcp:// URL, trick the victim into clicking on it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was reported to Microsoft on July, 5th by Google security researcher Tavis Ormandy.
The vulnerability was used to compromise Federal Financial Institutions Examination Council via “inform@ffiec.gov” mailbox.

Software: Windows

Known/fameous malware:

Mal/HcpExpl-A

The vulnerability was reported to Microsoft on July, 5th by Google security researcher Tavis Ormandy.
The vulnerability was used to compromise Federal Financial Institutions Examination Council via “inform@ffiec.gov” mailbox.

Buffer overflow in MPEG layer-3 codecs in Microsoft Windows
CVE-2010-0480

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to multiple boundary errors within Microsoft MPEG Layer-3 codecs when parsing AVI files. A remote unauthenticated attacker can create a specially crafted AVI file, trick the victim into opening it, trigger stack-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability was being actively exploited.

i

According to Symantec the first exploitation of the vulnerability was discovered on 26.03.2010.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.324

According to Symantec the first exploitation of the vulnerability was discovered on 26.03.2010.

Multiple vulnerabilities in Microsoft SharePoint
CVE-2010-0817

Cross-site scripting

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of user-supplied input data passed to Help.aspx script. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in victim’s browser in context of vulnerable SharePoint website.

Successful exploitation may allow an attacker to conduct phishing and drive-by-download attacks.

Note: this vulnerability is being publicly exploited.

Software: Microsoft SharePoint Server

Known/fameous malware:

Exploit: Win32/CVE-2010-0817

Remote code execution in Microsoft Internet Explorer
CVE-2010-0806

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in the Peer Objects component within iepeers.dll library. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability is declared as functional and was handled as a non-public zero-day exploit for at least 3274 days. The story of CVE-2010-0806 bears a certain similarity to the developments in the case of the targeted 'Aurora' attack where the exploit techniques were quickly adopted by the authors of web exploit kits for the use in massive web attacks. The country that suffered a huge loss by malware in April 2010 was China, with 22% of malware attacks. It was followed by Russia (17%), USA (10%), India (4%) and Germany (4%).

Software: Microsoft Internet Explorer

Known/fameous malware:

Some of the variants: Trojan:Win32/Wisp, TrojanDropper:Win32/Lisiu, TrojanDropper:Win32/Agent.gen!I, TrojanDownloader:Win32/Small.gen!AZ, Backdoor:Win32/Agent.FS, TrojanDropper:Win32/Frethog.

The vulnerability is declared as functional and was handled as a non-public zero-day exploit for at least 3274 days. The story of CVE-2010-0806 bears a certain similarity to the developments in the case of the targeted 'Aurora' attack where the exploit techniques were quickly adopted by the authors of web exploit kits for the use in massive web attacks. The country that suffered a huge loss by malware in April 2010 was China, with 22% of malware attacks. It was followed by Russia (17%), USA (10%), India (4%) and Germany (4%).

Integer overflow in Microsoft Paint
CVE-2010-0028

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

he vulnerability exists due to integer overflow when processing JPEG files using Microsoft Paint. A remote attacker can create a specially crafted JPEG file, trick the victim into opening it using Microsoft Pain application, trigger integer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.
i

The first attack using exploit for this vulnerability was detected in October 14, 2008 by Symantec. The attackers targeted 102 hosts using 127 malware variants.

Software: Paint

Known/fameous malware:

Bloodhound.Exploit.314

The first attack using exploit for this vulnerability was detected in October 14, 2008 by Symantec. The attackers targeted 102 hosts using 127 malware variants.

Remote code execution in Microsoft Internet Explorer
CVE-2010-0249

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in Microsoft Internet Explorer. A remote attacker can execute arbitrary code by accessing a pointer associated with a deleted object.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.

Software: Microsoft Internet Explorer

Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-2501

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in GDI+ when handling PNG image file. A remote attacker can create a specially crafted PNG image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-07.

Software: Windows

Known/fameous malware:

Bloodhoud.Exploit.277

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-07.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-3126

Integer Overflow or Wraparound

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in GDI+ when handling PNG image file. A remote attacker can create a specially crafted PNG image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-27.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.278.

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-27.

Two remote code execution vulnerabilities in Microsoft Windows
CVE-2009-0555

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing malformed Advanced Systems Format (ASF) files. A remote attacker can create a specially crafted audio file that uses the Windows Media Speech code, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows Media Format Runtime

Two vulnerabilities in Microsoft IIS FTP server
CVE-2009-3023

Stack-based buffer overflow

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in FTP server. A remote authenticated attacker can send a specially crafted FTP NLST command containing a wildcard that references a subdirectory, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The issue has been introduced in 06/02/1998. The weakness was publicly disclosed on August 31, 2009 by Kingcope. The vulnerability was handled as a non-public zero-day exploit.

Software: Microsoft IIS

The issue has been introduced in 06/02/1998. The weakness was publicly disclosed on August 31, 2009 by Kingcope. The vulnerability was handled as a non-public zero-day exploit.

Denial of service in Microsoft .NET Framework
CVE-2009-1536

Denial of service

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to incorrect managing of request scheduling by ASP.NET. By sending multiple HTTP requests, a remote attacker can trigger the Web server to crash.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft .NET Framework

Remote code execution in Microsoft Windows
CVE-2009-2493

Improper initialization

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper initialization in the Microsoft Active Template Library (ATL) when handling objects from data streams related to unsafe usage of OleLoadFromStream() function. A remote attacker can create a specially crafted Web site that instantiates a vulnerable component or control using the IE browser, trick the victim into viewing it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Active Template Library

Remote code execution in Microsoft Office Web Components
CVE-2009-1136

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in Office Web Components ActiveX Control when handling parameter values. A remote attacker can create a specially crafted Web page, trick the victim into viewing it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Office

Remote code execution in Microsoft Video ActiveX Control
CVE-2008-0015

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in the Microsoft Video ActiveX Control, msvidctl.dll. By persuading a victim to visit a specially crafted Web page, a remote attacker can trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been exploited in the wild since June 11, 2009 (as discovered by X-Force) and was touted by the media and by SANS as being exploited in the wild on July 6, 2009.

According to Symantec research first exploitation of the vulnerability was detected on 2008-12-28.

Software: Microsoft Video ActiveX Control

Known/fameous malware:

HTML/CVE-2008-0015
Bloodhoud.Exploit.259

The vulnerability has been exploited in the wild since June 11, 2009 (as discovered by X-Force) and was touted by the media and by SANS as being exploited in the wild on July 6, 2009.

According to Symantec research first exploitation of the vulnerability was detected on 2008-12-28.

Multiple vulnerabilities in Microsoft Excel
CVE-2009-1134

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when parsing the Excel spreadsheet file format. A remote attacker can create a specially crafted Excel file containing a malformed record pointer, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

The vulnerability has been exploited over a year and was reported to vendor on 2009-03-26.
According to Symantec the first exploitation of the vulnerability was discovered on 2008-07-25.

Software: Microsoft Excel

Known/fameous malware:

Bloodhound.Exploit.254.

The vulnerability has been exploited over a year and was reported to vendor on 2009-03-26.
According to Symantec the first exploitation of the vulnerability was discovered on 2008-07-25.

Multiple vulnerabilities in Microsoft Excel
CVE-2009-0561

Integer Overflow or Wraparound

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow when parsing the Excel spreadsheet file format. A remote attacker can create a specially crafted Excel file containing a malformed object record, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
i

According to Symantec the first exploitation of the vulnerability was discovered on 11.01.2009.

Software: Microsoft Excel

Known/fameous malware:

Bloodhound.Exploit.251

According to Symantec the first exploitation of the vulnerability was discovered on 11.01.2009.

Multiple priviledge escalation vulnerabilities in Microsoft Windows
CVE-2009-1123

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper validation of changes in certain kernel objects. By running a malicious application, a local attacker can submit malformed calls to the Windows Kernel and execute arbitrary code in kernel mode.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

This vulnerability was used by Equation group in attacks, which involved Fanny malware. The exploit is later added to Stuxnet malware. Initially discovered by Kaspersky Lab in December 2008.

Microsoft bulletin describing 4 vulnerabilities is not clear on which vulnerability was used during the attacks. We are aware of at least two publicly disclosed exploits from this bulletin used by different malware in targeted attacks during Operation Pawn Storm and Turla.

The CVEs covered in this bulletin: CVE-2009-1123, CVE-2009-1124, CVE-2009-1125, CVE-2009-1126. At least one of them has being exploited in the wild before official security patch.

Software: Windows

Known/fameous malware:

Exploit kits: Fanny, Stuxnet, Turla.

This vulnerability was used by Equation group in attacks, which involved Fanny malware. The exploit is later added to Stuxnet malware. Initially discovered by Kaspersky Lab in December 2008.

Microsoft bulletin describing 4 vulnerabilities is not clear on which vulnerability was used during the attacks. We are aware of at least two publicly disclosed exploits from this bulletin used by different malware in targeted attacks during Operation Pawn Storm and Turla.

The CVEs covered in this bulletin: CVE-2009-1123, CVE-2009-1124, CVE-2009-1125, CVE-2009-1126. At least one of them has being exploited in the wild before official security patch.

Remote code execution in Microsoft DirectX
CVE-2009-1537

Null byte interaction error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to NULL byte error in DirectX. A remote attacker can create a specially crafted QuickTime media file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft DirectX

Known/fameous malware:

Exploit:JS/Mult.BM
Exploit:Win32/CVE-2009-1537

Multiple vulnerabilities in Microsoft Powerpoint
CVE-2009-0556

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malformed PowerPoint files. A remote attacker can create a specially crafted PowerPoint file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft PowerPoint

Remote code execution in Microsoft Windows
CVE-2009-0084

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing a malformed JPEG file. A remote attacker can create a specially crafted JPEG file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability is being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2008-10-23.

Software: Microsoft DirectX

According to Symantec the first exploitation of the vulnerability was discovered on 2008-10-23.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0087

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when process documents in Microsoft WordPad and Microsoft Office converter. A remote attacker can create a specially crafted Word file containing a malformed data, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was handled as a non-public zero-day exploit for at least 3344 days. The issue has been introduced in 02/17/2000.
The vulnerability was firstly disclosed in June 17, 2008.

Software: Windows

The vulnerability was handled as a non-public zero-day exploit for at least 3344 days. The issue has been introduced in 02/17/2000.
The vulnerability was firstly disclosed in June 17, 2008.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0078

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient security protections in Windows Management Instrumentation (WMI) providers. Accessing the computer under the context of a NetworkService or LocalService account an attacker can obtain privileged security tokens and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control over the affected system.

Note: this vulnerability was being actively exploited.
i

Knows as Token Kidnapping.

Software: Windows

Knows as Token Kidnapping.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0079

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper isolation of processes in the RPCSS service. Accessing the computer under the context of a NetworkService or LocalService account an attacker can obtain privileged security tokens and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: this vulnerability was being actively exploited.


i

Known as "Token Kidnapping".

Software: Windows

Known as "Token Kidnapping".

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0080

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to incorrect placing of access control lists (ACLs) on threads in the current ThreadPool. By leveraging incorrect thread ACLs an attacker can access NetworkService or LocalService account, obtain elevated privileges and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: this vulnerability was being actively exploited.
i

Known as "Token Kidnapping".

Software: Windows

Known as "Token Kidnapping".

Two vulnerabilities in Microsoft IIS FTP server
CVE-2009-2521

Improper input validation

The vulnerability allows a remote authenticated attacker to cause DoS conditions on the target system.

The weakness exists due to an error when processing recursive directory listing commands by the FTP Service. By sending a specially crafted LIST command containing wildcard characters, a remote attacker can trigger the FTP service to crash.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The issue has been introduced in 02/17/2000. The weakness was disclosed on 09/04/2009 by Kingcope.

Software: Microsoft IIS

The issue has been introduced in 02/17/2000. The weakness was disclosed on 09/04/2009 by Kingcope.

Remote code execution in Microsoft Excel
CVE-2009-0238

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when parsing the Excel spreadsheet file format. A remote attacker can create a specially crafted Excel file containing a malformed object, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Known/fameous malware:

TROJ_MDROPPER.XR (TrendMicro)
Exploit - MSExcel.r (McAfee)
Trojan.Mdropper.AC (Symantec)

Remote code execution in Microsoft Word
CVE-2008-4841

Stack-based buffer overflow

The vulnerability alows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to stack overflow when parsing a malicious document. A remote attacker can create a specially crafted Word file containing a malformed list structure, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft WordPad

Known/fameous malware:

Exploit: Win32/CVE-2008-4841

Remote code execution in Microsoft Windows
CVE-2008-4844

Use-after-free

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer. A remote attacker can construct a specially crafted Web page, trick the victim into viewing it, trigger memory corruption and execute arbitrary code via DSO bindings involving an XML Island,  XML DSOs, or Tabular Data Control (TDC) in a crafted HTML or XML document.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Internet Explorer

Two remote code execution vulnerabilities in Microsoft Windows
CVE-2008-2249

Integer Overflow or Wraparound

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow when processing malformed WMF image file. By persuading the victim to open a specially crafted WMF image file containing a malformed header, a remote attacker can cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

According to Symantec first exploitation of this vulnerability was detected on 2008-10-14.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.214.

According to Symantec first exploitation of this vulnerability was detected on 2008-10-14.

Remote code execution in Microsoft Windows
CVE-2008-4250

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow during path canonicalization in Windows Server service. By sending a specially crafted RCP request, a remote attacker can cause memory corruption and execute arbitrary code with privileges of system account.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.
i

According to Symantec, first exploitation of this vulnerability was detected on 2008-02-05. The vulnerability was used by the Conficker worm.

Software: Windows

Known/fameous malware:

Trojan (Gimmiv.A) and a Trojan searching for non-patched machines on LAN (Arpoc.A)
W32.Downadup aka Conficker
W32.Downadup.B
W32.Fujacks.CE
W32.Neeris.C
W32.Wapomi.B

According to Symantec, first exploitation of this vulnerability was detected on 2008-02-05. The vulnerability was used by the Conficker worm.

Remote code execution in Microsoft Windows
CVE-2008-3704

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a buffer overflow in the Masked Edit ActiveX Control. A remote attacker can construct a specially crafted Web page, trick the victim into viewing it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Masked Edit ActiveX Control

Remote code execution in Microsoft Word
CVE-2008-2244

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when handling malformed Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was being used in a 2008 Summer Olympics-themed attack.

Software: Microsoft Word

The vulnerability was being used in a 2008 Summer Olympics-themed attack.

Remote code execution in Microsoft Access
CVE-2008-2463

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the ActiveX control for the Snapshot Viewer for Microsoft Access. A remote attacker can construct a specially crafted Web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Office

Known/fameous malware:

JS/Exploit.CVE-2008-2463.A
Exploit kits using this vulnerability: Eleonore and Siberia.

Remote code execution in Microsoft Windows Internet Printing Service
CVE-2008-1446

Integer overflow

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in Windows Internet Printing Protocol (IPP) implementation. By sending a specially crafted HTTP POST request, a remote authenticated attacker can cause memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to US CERT, the targeted attacks were spotted on May 2, 2008.

Software: Windows

According to US CERT, the targeted attacks were spotted on May 2, 2008.

Privilege escalation in Microsoft Windows
CVE-2008-1436

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper security restrictions on security tokens in the Microsoft Distributed Transaction Coordinator (MSDTC) service. By sending a specially crafted request to the MSDTC service, an attacker can access privileged security tokens and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: this vulnerability was being actively exploited.
i

The vulnerability was used in Operation Iron Tiger, a cyber espionage campaign carried out by Chinese hackers on United States Defense Contractors.

Software: Windows

The vulnerability was used in Operation Iron Tiger, a cyber espionage campaign carried out by Chinese hackers on United States Defense Contractors.

Remote code execution in Microsoft Jet
CVE-2007-6026

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Jet database engine when parsing .mdb files. A remote attacker can create a specially crafted .mdb file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is publicly disclosed since 2005, however an attack vector was introduced only in 2008. The vulnerability is being actively exploited.
i

The vulnerability initially had three CVEs: CVE-2005-0944, CVE-2007-6026 and CVE-2008-1092.
The issue has been introduced on 02/17/2000. The vulnerability was handled as a non-public zero-day exploit for at least 2832 days.

Software: Microsoft Jet

Known/fameous malware:

Trojan.Acdropper.C

The vulnerability initially had three CVEs: CVE-2005-0944, CVE-2007-6026 and CVE-2008-1092.
The issue has been introduced on 02/17/2000. The vulnerability was handled as a non-public zero-day exploit for at least 2832 days.

Multiple vulnerabilities in Microsoft Excel
CVE-2008-0081

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a boundary error when handling macros in Excel files. A remote attacker can create a specially crafted Excel file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Known/fameous malware:

mx97:cve-2008-0081 virus
Exploit-MSExcel.p

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2007-5347

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when handling certain DHTML object methods. A remote attacker can create a specially crafted HTML page, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Privilege escalation in Macrovision SafeDisc driver for Microsoft Windows
CVE-2007-5587

Buffer overflow

The vulnerability allows a local user to escalation privileges on vulnerable system.

The vulnerability exists due to incorrect handling of configuration parameters within Macrovision SafeDisc SECDRV.SYS driver, shipped by default with Windows XP and Windows 2003 operating systems. A local user pass specially crafted parameters to METHOD_NEITHER IOCTL and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of this vulnerability allows a local unprivileged user to elevate his privileges and gain administrative access to vulnerable system.

Note: the vulnerability is being actively exploited.

Software: Windows

Remote code execution via URI handlers in Microsoft Windows
CVE-2007-3896

OS command injection

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insufficient filtration of URIs in Shell32.dll when open applications via URL handlers (e.g. mailto:). A remote attacker can create a specially crafted URI, containing invalid sequence of % characters, trick the victim to click on it and execute arbitrary system commands with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows

Remote code execution in Microsoft Word
CVE-2007-3899

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed strings in Word document. A remote attacker can create a specially crafted MS Word document, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Word

Remote code execution in Microsoft DNS server
CVE-2007-1748

Stack-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing RPC requests in Microsoft Windows DNS server, which contain long zone name parameter with escaped octal strings.
A remote attacker can send a specially crafted RPC request to vulnerable DNS server, cause stack-based buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows Server

Remote code execution in Microsoft Windows
CVE-2007-0038

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling cursor, animated cursor, and icon formats. A remote attacker can create a specially crafted malicious cursor or icon file, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered in the wild by McAfee.

Software: Windows

This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered in the wild by McAfee.

Remote code execution in Microsoft Word
CVE-2007-0870

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed stream in Word document. A remote attacker can create a specially crafted MS Word document, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

According to CERT, this vulnerability has been actively exploited in the wild before official patch release.

Software: Microsoft Word

According to CERT, this vulnerability has been actively exploited in the wild before official patch release.

Buffer overflow in Microsoft Excel
CVE-2007-0671

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed records in Excel files. A remote attacker can create a specially crafted Excel file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The attack was reported on February 2007. The exploit dropped malware that used www.top10member.com C&C server. According to TrendMicro, the malware functionality was very similar to BKDR_SYKIPOT.B.

Software: Microsoft Excel

Known/fameous malware:

Exploit-MSExcel.h.

The attack was reported on February 2007. The exploit dropped malware that used www.top10member.com C&C server. According to TrendMicro, the malware functionality was very similar to BKDR_SYKIPOT.B.

Remote code execution in Microsoft Word
CVE-2007-0515

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when processing malformed function in Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


Software: Microsoft Word

Known/fameous malware:

Backdoor.Trojan Downloader
Backdoor.Pcclient.B (MCID 8260)
Backdoor.Ginwui.E (MCID 8890)
Trojan.Mdropper.W

Buffer overflow in Internet Explorer VML
CVE-2007-0024

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Vgx.dll library when handling Vector Markup Language (VML) tags. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in Microsoft Word
CVE-2006-6561

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when processing  an unchecked word count in Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


i

This vulnerability was publicly disclosed by Disco Jonny.

Software: Microsoft Word

Known/fameous malware:

Bloodhound.Exploit.108.

This vulnerability was publicly disclosed by Disco Jonny.

Remote code execution in Microsoft Word
CVE-2006-6456

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when handling Word files with a specially crafted data structure. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


Software: Microsoft Word

Known/fameous malware:

Trojan.Mdropper.U

Remote code execution in Microsoft Word
CVE-2006-5994

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when handling Word files with a specially crafted string. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


Software: Microsoft Word

Known/fameous malware:

Bloodhound.Exploit.106

Remote code execution in Microsoft XML Core Services
CVE-2006-5745

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error in XMLHTTP ActiveX control within Microsoft XML Core Services. A remote unauthenticated attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

The issue was discovered in the wild by ISS xForce.

Software: Microsoft XML Core Services

The issue was discovered in the wild by ISS xForce.

Remote code execution in Visual Studio WMIObjectBroker2 ActiveX control
CVE-2006-4704

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of input data in Microsoft WMIScriptUtils.WMIObjectBroker2 ActiveX control (WmiScriptUtils.dll), bundled with Visual Studio 2005. A remote unauthenticated attacker can trick the victim to open a specially crafted web page or HTML file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was publicly reported by Michal Bucko and H D Moore.

Software: Visual Studio

This vulnerability was publicly reported by Michal Bucko and H D Moore.

Remote code execution in WebViewFolderIcon ActiveX control in Microsoft Windows
CVE-2006-3730

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper validation of input parameters passed to vulnerable setSlice() method in WebViewFolderIcon ActiveX control (Web View). A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows

Remote code execution in Microsoft PowerPoint
CVE-2006-4694

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by a boundary error when parsing malformed records within the PowerPoint file. A remote attacker can create a specially crafted .ppt file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


i

It has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.

Software: Microsoft PowerPoint

Known/fameous malware:

Exploit:Win32/Controlppt.W, Exploit:Win32/Controlppt.X, and Exploit-PPT.d/Trojan.PPDropper.F.

It has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.

Remote code execution in Microsoft Windows
CVE-2006-4868

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of input data in Vector Markup Language (VML) implementation (VGX.dll) in Microsoft Windows. A remote unauthenticated attacker can trick the victim to open a specially crafted web page or HTML file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was reported by Sunbelt Software.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.78

This vulnerability was reported by Sunbelt Software.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2006-4777

Heap-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow within DirectAnimation Path ActiveX control (daxctle.ocx) when handling unexpected input. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Multiple vulnerabilities in Microsoft Word
CVE-2006-4534

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to stack-based buffer overflow. By persuading the victim to load and open a specially crafted Word document containing a malformed string, a remote attacker can execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.
i

This vulnerability was reported by Juha-Matti Laurio.

Software: Microsoft Office

Known/fameous malware:

Trojan.Mdropper.Q

This vulnerability was reported by Juha-Matti Laurio.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2006-4446

Heap-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow in DirectAnimation.PathControl ActiveX control (daxctle.ocx) when handling unexpected input. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in Microsoft VBA
CVE-2006-3649

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to buffer overflow. By persuading the victim to open a malicious Office document containing Visual Basic for Applications (VBA) script, a remote attacker can execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.
i

The weakness was disclosed 08/08/2006 by Ka Chun Leung with Symantec.

Software: Microsoft Office

Known/fameous malware:

Trojan.Mdropper.N

The weakness was disclosed 08/08/2006 by Ka Chun Leung with Symantec.

Buffer overflow in Microsoft Windows Server service
CVE-2006-3439

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Microsoft Windows Server Service. A remote attacker can send a specially crafted packet to port 139/TCP or 445/TCP, trigger boundary error and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows

Remote code execution in Microsoft PowerPoint
CVE-2006-3590

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to memory corruption in mso.dll. By persuading the victim to open a specially crafted PPT file, containing a malformed shape container, a remote attacker can execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in complete compromise of vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft PowerPoint

Known/fameous malware:

PPDropper.B Trojan.
Bloodhound.Exploit.79

Multiple vulnerabilities in Microsoft Excel
CVE-2006-1301

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of input data when processing a malformed SELECTION record within Excel file. A remote unauthenticated attacker can trick the victim to open a specially crafted Excel file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Multiple vulnerabilities in Microsoft Office
CVE-2006-1540

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed strings in Office documents. A remote attacker can create a specially crafted Office file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Office

Multiple vulnerabilities in Microsoft Excel
CVE-2006-3059

Remote code execution

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to a stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName() function. By persuading the victim to open a specially crafted Excel file, a remote attacker can cause DoS conditions or execute arbitrary code via a long hyperlink.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Known/fameous malware:

Mdropper.J Trojan.

Remote code execution in Microsoft Word
CVE-2006-2492

Remote code execution

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to buffer overflow. By persuading the victim to open a specially crafted Word file containing a malformed object pointer, a remote attacker can execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Word

Known/fameous malware:

Mdropper.H Trojan.
SmartTag exploit.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2006-1359

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in createTextRange() DHTML method when handling unexpected user input for radio button control. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Known/fameous malware:

Kaspersky - Exploit.JS.CVE-2006-1359.d
Ikarus - Exploit.JS.CVE-2006-1359.d
Nod32 - JS/Exploit.CVE-2006-1359

Remote code execution in Microsoft Windows GDI
CVE-2005-4560

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Microsoft Graphical Device Interface library (GDI32.DLL) when handling .wmf files. A remote attacker can create a specially crafted .wmf image file with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was disclosed on December 27, 2005. We have decided however to include it into 2006 year due to very close timing.

Software: Windows

This vulnerability was disclosed on December 27, 2005. We have decided however to include it into 2006 year due to very close timing.

Vulnerability Scanning SaaS

Vulnerability scanning SaaS service is online 3-rd generation vulnerability scanner with scheduled assessments and vulnerability subscription. You can use service to check security of your network perimeter.