The Spring Dragon APT

CVE-2010-2883 is a stack-based buffer overflow (CWE-119) in Adobe Acrobat and Adobe Reader that can be triggered remotely, for example by opening attacker-supplied PDF content. Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the local user, or to crash the application and cause a denial of service. Anyone running a vulnerable build of Adobe Acrobat or Reader is affected, and this flaw is one of the long-lived 'old Adobe flaws' that malware campaigns have been observed leveraging, as reflected in related reporting on an Asruex Trojan variant and the Spring Dragon APT. Exploitation status is significant for a vulnerability of this age: it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08, required action: apply updates per vendor instructions), EPSS assigns an 82.5% probability of exploitation within 30 days (100th percentile), and no public proof-of-concept is currently cataloged; ransomware use is unknown.

Do: Apply vendor updates per Adobe's instructions, as required by CISA's KEV listing, and upgrade all Acrobat and Reader installations to a currently patched release. Inventory endpoints for legacy or unsupported Adobe Reader/Acrobat builds and prioritize patching for users who routinely handle untrusted PDFs. Until patched, treat unsolicited PDF attachments with caution and verify sender authenticity; no public PoC is known, but active exploitation is cataloged.

CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days.

Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching.

CVE-2014-6332 is a memory-corruption flaw (CWE-119) in OleAut32.dll, the OLE Automation component shipped with Microsoft Windows, in which OLE automation arrays are mishandled, allowing out-of-bounds memory access. A remote attacker triggers it by luring a user to a crafted website whose script (typically executed through Internet Explorer) calls into the vulnerable OLE Automation code, corrupting memory on the victim machine. Successful exploitation yields remote code execution with the privileges of the logged-on user, generally giving the attacker full control of the workstation. Because OleAut32.dll is a core OS component, essentially every Windows client and server in circulation at the time was affected; Microsoft addressed it in the November 2014 security updates (MS14-064). The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating known in-the-wild exploitation, and EPSS assigns a 95% probability of exploitation within 30 days (100th percentile); no public PoC is tracked in the source data.

Do: Apply Microsoft's November 2014 Windows/OLE security updates (MS14-064) across all Windows clients and servers, prioritizing internet-facing systems and workstations used for web browsing, and confirm the patched OleAut32.dll is present via patch-management or vulnerability-scanner checks. Because the flaw is KEV-listed and exploitable in a drive-by web-attack scenario, treat any remaining unpatched Windows host as high risk and isolate legacy systems that cannot be updated.