60
CVE-2016-0034
KEV ransomwaremassRemote Code Execution via Crafted Website in Microsoft Silverlight 5
CISA: Microsoft Silverlight Runtime Remote Code Execution Vulnerability
CVSS 3.1
8.8 high
EPSS
70%p99
Published
()
KEV added
AI analysis
CVE-2016-0034 is a memory-corruption flaw in the Microsoft Silverlight 5 runtime, which mishandles negative offsets during decoding, corrupting object headers. An attacker triggers it by convincing a user to visit a crafted website while the vulnerable Silverlight plug-in is active in their browser, requiring no privileges but user interaction. Successful exploitation allows the attacker to execute arbitrary code in the context of the logged-in user (or crash the browser/application). Anyone running Microsoft Silverlight 5 versions before 5.1.41212.0 is affected; Silverlight is now end-of-life, so remaining installations are legacy deployments. The flaw was exploited in the wild through exploit kits such as Angler and RIG to deliver ransomware like Cerber, and it was added to the CISA KEV catalog in May 2022 with known ransomware use.
What to do: Upgrade Silverlight to version 5.1.41212.0 (January 2016 security update) on any system where it remains installed. Because Silverlight is end-of-life, CISA's KEV required action is to disconnect or remove it and migrate any legacy Silverlight-based web applications; prioritize internet-facing endpoints and users of Internet Explorer/legacy browsers, where the plug-in can still be invoked.
Affected
| microsoft Silverlight | Silverlight 5 before 5.1.41212.0 (fixed in 5.1.41212.0, January 2016 Patch Tuesday) |
Estimated exposure
masshistorically hundreds of millions of installs (Silverlight reached roughly 70% of consumer devices at peak); residual active installs today likely number in… — Silverlight shipped broadly with Windows and Microsoft reported very high consumer penetration at its peak, and it remained widely deployed in enterprise line-of-business browser apps, though the plug-in is now end-of-life and most modern…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CISA Known Exploited Vulnerability
- Affected
- Microsoft Silverlight
- Required action
- The impacted products are end-of-life and should be disconnected if still in use.
- Due date
- Ransomware use
- Known
- Vendors
- microsoft
- Products
- silverlight
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news8 stories
60
60
60
60
60
47
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.
36