Tracking Moving Targets: Exploit Kits and CVEs

CVE-2012-0507 is an 'incorrect type' (type-confusion) vulnerability in the Concurrency component of Oracle's Java Runtime Environment that corrupts memory when crafted Java content is processed. It is triggered by running malicious Java content — classically via the browser Java plugin or an exploited Java application — allowing an attacker to execute arbitrary code with the privileges of the Java process. Anyone running an affected Oracle Java SE installation is exposed, which historically included the vast majority of desktops and many servers, with 2012-era campaigns hitting Mac users via Java exploits (e.g., the SabPub backdoor) and drive-by exploit kits. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware use, and EPSS assigns a 98.1% probability of exploitation within 30 days (100th percentile). CVSS has not been scored in the source data, but the combined KEV/EPSS signal marks this as actively and widely exploited.

Do: Apply Oracle's Java SE updates per CISA's required action — Oracle shipped the fix in its February 2012 Critical Patch Update, so any current, fully patched Java release clears the flaw; verify no legacy unpatched Java builds (including Apple-delivered Java on macOS, given the 2012 OS X exploitation campaigns) remain on endpoints. Remove or disable the Java browser plugin where it is not required, and restrict execution of untrusted applets and Java Web Start content.

CVE-2013-0074 is a double dereference (dangling pointer) flaw in Microsoft Silverlight: the runtime does not properly validate pointers while rendering HTML objects, corrupting memory when a malformed pointer is dereferenced. An attacker triggers it by getting a user to view a web page or open content that loads a crafted Silverlight application, with no authentication or special privileges required. Successful exploitation allows remote code execution in the context of the logged-on user, potentially letting an attacker install programs, steal data, or create accounts. Any system with the Silverlight runtime installed is affected; per CISA's required action the product is end-of-life (Silverlight support ended in October 2021) and should be disconnected if still in use. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-25 with known ransomware use, and EPSS puts its 30-day exploitation probability at 81% (100th percentile), despite the absence of a known public PoC.

Do: Audit inventories and endpoints for any Silverlight runtime or .xap-consuming applications and remove/uninstall the plugin where possible; if the runtime must be retained, ensure the March 2013 MS13-022 security update or a later Silverlight 5.1 runtime is installed. Because Silverlight is end-of-life with no further patches, follow CISA's required action: disconnect or retire any remaining Silverlight-dependent applications, and block known exploit-kit delivery vectors (drive-by web content) with updated browser and email filtering.

CVE-2013-2465 is an unspecified vulnerability in the Java Runtime Environment (JRE) component of Oracle Java SE, located in the 2D graphics/rendering subsystem. It is triggered via unknown vectors related to 2D, typically when a hostile applet or application causes the JRE to process crafted graphical content. An attacker who successfully exploits it can affect confidentiality, integrity, and availability, which in practice means remote compromise of the affected system without user credentials. Any deployment of Oracle Java SE — end-user desktops with the browser plugin and servers running JRE releases current at the time of the June 2013 Oracle Critical Patch Update — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-28 with known ransomware use, EPSS assigns it a 98.7% probability of exploitation within 30 days (top percentile), and related 2013-era reporting around exploit kits such as LightsOut documents the era's heavy exploit-kit targeting of Java.

Do: Apply the June 2013 Oracle Java SE Critical Patch Update, or any later supported Java SE release, per vendor instructions as CISA requires. Audit environments for legacy JRE installs and enabled Java browser plugin/applet support — especially on user-facing and internet-exposed legacy servers — and remove or upgrade them. Because CISA lists known ransomware use, prioritize patching external-facing and end-user systems.

CVE-2013-2551 is a use-after-free memory corruption flaw (CWE-416) in Microsoft Internet Explorer. An attacker triggers it by luring a user to a crafted website that causes the browser to access an object that has already been deleted from memory. Successful exploitation allows the attacker to execute arbitrary code on the victim machine, typically in the context of the logged-in user. All Internet Explorer deployments are potentially affected; the source data does not specify version ranges, but the flaw is best known as a long-lived legacy-browser issue exploited by drive-by exploit kits. The vulnerability is confirmed to be exploited in the wild: it is listed in CISA KEV (added 2022-03-28) with known ransomware use, and EPSS assigns it a 74.1% probability of exploitation in the next 30 days (99th percentile).

Do: Apply Microsoft updates for Internet Explorer per vendor instructions, as required by the CISA KEV listing, prioritizing any Windows systems still using IE or IE-based components. As interim mitigation, restrict browsing to trusted sites and ensure users are not running as administrators for routine web activity. Audit legacy environments for obsolete IE usage and migrate those systems to a supported, actively patched browser where updates are no longer feasible.

CVE-2013-3896 is an information-disclosure flaw in Microsoft Silverlight caused by improper input validation (CWE-20): Silverlight does not correctly validate pointers when accessing Silverlight elements. An attacker triggers it by inducing a user to run a crafted Silverlight application, typically delivered through a malicious or compromised web page. Successful exploitation allows the attacker to obtain sensitive information from the affected system, though the flaw does not provide code execution. All deployments of Microsoft Silverlight are affected, and the product is now end-of-life per CISA. The flaw is listed in the CISA KEV catalog (added 2022-05-25) and carries a high probability of exploitation (EPSS 69.6%, 99th percentile), with ransomware use listed as unknown; no public PoC is known.

Do: Because Microsoft Silverlight is end-of-life, CISA's required action is to disconnect or retire any systems still using it; the cleanest fix is to uninstall the Silverlight runtime where it is no longer needed. If Silverlight must remain on legacy systems, apply Microsoft's October 2013 Patch Tuesday Silverlight security update (released the same cycle as the IE zero-day fixes). Audit endpoints and web apps for Silverlight dependencies, and treat any remaining Silverlight-enabled browsing paths as legacy risk.

CVE-2014-0497 is an integer underflow (CWE-191) in Adobe Flash Player that allows a remote attacker to execute arbitrary code, triggered when the player processes specially crafted Flash content, such as that embedded in a malicious web page. Successful exploitation gives the attacker code execution on the victim system in the context of the Flash Player process. At the time of the 2014 disclosure, essentially every deployed Adobe Flash Player installation was potentially affected, making the population of exposed systems enormous, though Flash has since reached end-of-life and is no longer patched. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2024-09-17, indicating confirmed in-the-wild exploitation; no public proof-of-concept is documented and ransomware association is listed as unknown. EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), so any residual Flash deployment should be treated as high risk.

Do: Because Adobe Flash Player is end-of-life/end-of-service and no longer receives security updates, CISA's required action is to discontinue use: uninstall Flash Player, disable or remove Flash plugins from browsers, and audit legacy Windows systems and intranet applications for residual Flash components. Since Flash is EOL, do not rely on patching alone — blocking SWF content delivery and removing the runtime are the durable mitigations; prioritize any systems that still render Flash from untrusted sources given the 99.9% EPSS score and KEV listing.

CVE-2014-6332 is a memory-corruption flaw (CWE-119) in OleAut32.dll, the OLE Automation component shipped with Microsoft Windows, in which OLE automation arrays are mishandled, allowing out-of-bounds memory access. A remote attacker triggers it by luring a user to a crafted website whose script (typically executed through Internet Explorer) calls into the vulnerable OLE Automation code, corrupting memory on the victim machine. Successful exploitation yields remote code execution with the privileges of the logged-on user, generally giving the attacker full control of the workstation. Because OleAut32.dll is a core OS component, essentially every Windows client and server in circulation at the time was affected; Microsoft addressed it in the November 2014 security updates (MS14-064). The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating known in-the-wild exploitation, and EPSS assigns a 95% probability of exploitation within 30 days (100th percentile); no public PoC is tracked in the source data.

Do: Apply Microsoft's November 2014 Windows/OLE security updates (MS14-064) across all Windows clients and servers, prioritizing internet-facing systems and workstations used for web browsing, and confirm the patched OleAut32.dll is present via patch-management or vulnerability-scanner checks. Because the flaw is KEV-listed and exploitable in a drive-by web-attack scenario, treat any remaining unpatched Windows host as high risk and isolate legacy systems that cannot be updated.