CVE-2013-3906 : Another 0
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2013-3906 | Memory Corruption RCE in Microsoft Graphics Component (Actively Exploited) Microsoft's Graphics Component contains a memory corruption vulnerability that can allow remote code execution when the component processes maliciously crafted graphics content, typically delivered inside documents or other rendered content. An attacker who successfully triggers the flaw gains the ability to execute arbitrary code on the target system in the context of the current user, inheriting that user's privileges. Any Microsoft Windows system running an affected version of the Graphics Component is exposed, since the component is part of the Windows platform and is reachable through normal document and image rendering. The flaw was exploited as a zero-day in targeted attacks — notably by the Sandworm threat group against Ukrainian government and NATO-related targets, per iSight Partners reporting — and was addressed in Microsoft's December 2013 security updates. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15, and EPSS currently assigns an 85% probability of exploitation within 30 days (100th percentile). Do: Apply the vendor's December 2013 security updates covering the Graphics Component (MS13-098) to all Windows systems, prioritizing legacy machines that may have never received the patch, and verify KEV remediation compliance if you are a federal agency. Because exploitation vectors historically involved malicious document rendering, reinforce email filtering and Office attack-surface reduction (e.g., blocking untrusted embedded graphics/objects) on any systems that remain unpatched. | — | 85% | KEV |
| mass≈1 billion+ Windows installations carried the component at the time of disclosure; residual exposure is limited to systems never patched with the December 2013… |
Full article611 words · extracted from securelist.com · click to collapse
On November 5, Microsoft announced the discovery of a new vulnerability CVE-2013-3906 which can be exploited when TIFF images are processed. By exploiting this vulnerability it is possible to attack software – including Microsoft Office and Lync – that uses a vulnerable DLL for processing TIFF images. On the same day, there were reports that Microsoft had recorded attacks that exploit CVE-2013-3906.
Several malware samples became available to us that exploit CVE-2013-3906. We analyzed them in detail. All of them make use of heap spraying, recording their code to the address 0x08080808, and execute the code from that location. Exception generation and memory rewrite is performed in the vulnerable ogl.dll.
Fragment of WinDbg shellcode execution
The exploits that we had access to can be divided into two groups according to the shellcodes used in them.
The exploits in the first group use a primitive and unencrypted shellcode whose only task is to download and launch malicious software.
Shellcode of an exploit in the first group
The payload drops a clean .doc file that is displayed to dispel any suspicions the user may have, as well as a malicious program that was earlier spotted in the HangOver attack. That is a backdoor, written in C++ and which isn’t even encrypted.
Fragment of the contents of the clean .docx file
The exploits in the second group are much more sophisticated. For starters, the shellcode they use is already encrypted with standard XOR. After decryption, it became clear that it doesn’t download and launch malicious code, unlike most exploits, including those in the first group targeting CVE-2013-3906.
Decrypted shellcode of an exploit from the second group
There is an OLE2 object integrated into the original .docx document; this object is read in the shellcode. It contains a data stream, consisting of 6 bytes located ahead of the encrypted data, which contains the original decryption key, a dynamic decryption key, and the length of the decrypted data stream. The decryption algorithm is a standard XOR with a key modified with the byte operation ADD.
Fragment of packed data and the header (in red box) containing the keys and the size
After decryption, this data transforms into a DLL named a.l, which is loaded within the process winword.exe. This DLL drops a.exe which is the backdoor Citadel.
Fragment of an unpacked sample of Citadel
It means there are already two groups of cybercriminals out there who are using the new vulnerability.
Interestingly, the TIFF files in the second category of exploits are dated March 2013, but we registered the first appearance of these exploits on July 31. They used the storage, encryption and payload launch technique described above. But the actual payload differs in earlier exploits. In the new samples a dynamic library is dropped which in turn drops and runs an executable file and a clean .docx. In earlier samples the DLL is different and it drops a different clean .docx file and a vbe script. The same vbe script is used in the cross-platform malware Janicab.
Fragment of the dropped .docx from the July sample of the exploit
It appears that either the same people were responsible for spreading Citadel and Janicab – from the exploit to the payload – or someone is selling malware distribution services that make use of 0-day exploits.
From the moment such exploits appear, our Advanced Exploit Prevention (AEP) technology protects users from the launch of malicious code by applications that have been attacked by exploits targeting CVE-2013-3906. By responding to anomalies in the behavior of popular app processes, AEP makes it possible to block the launch of exploits.
These exploits are detected by static signatures as Exploit.Win32.CVE-2013-3906.a.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/cve-2013-3906-another-0-day-for-microsoft-office/57208/