Internet Explorer Vulnerability(MS12-043) Exploited in the Wild (August 30, 2013)

Dell Sonicwall Threats Research team has found multiple instances of malicious websites exploiting this old Internet Explorer Vulnerability. This vulnerability is already patched and has been assigned CVE-2012-1889. Metasploit also has a module msxml_get_definition_code_exec and we can see some similarities in the exploit code as outlined below.

There is obfuscation, heap allocation and shellcode setup.

Vulnerable "MSXML3" control is included followed by its function call "definition" that triggers the condition.

Debugging shows heap spray and download of the url containing malicious executable.

A separate variant uses IP address for executable download

We detect multiple variants of this attack by following IPS signatures

7967 Microsoft XML Core Services Uninitialized Object Access 1
8007 Microsoft XML Core Services Uninitialized Object Access 6
7610 HTTP Client Shellcode Exploit 68b
7370 HTTP Client Shellcode Exploit 68a
5416 HTTP Client Shellcode Exploit 15a
4604 HTTP Client Shellcode Exploit 1a
4605 HTTP Client Shellcode Exploit 2

Share This Article

An Article By

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.