2 Zero-Days found in March were part of a cyber weapon in an early development stage
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-4990 | Double Free RCE in Adobe Acrobat and Reader CVE-2018-4990 is a double free (CWE-415) memory-corruption vulnerability in Adobe Acrobat and Reader, in which the application frees the same memory allocation twice while handling a crafted PDF document. An attacker who convinces a user on a vulnerable build to open a malicious PDF (e.g., via email attachment or web download) can corrupt heap memory and achieve remote code execution in the context of the logged-in user. Anyone running vulnerable releases of Adobe Acrobat or Reader is affected; the provided data does not enumerate specific version ranges, so unpatched builds from the disclosure era should be treated as potentially vulnerable. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08), confirming exploitation in the wild; no public proof-of-concept is known, ransomware association is unknown, and EPSS assigns a high 36.6% probability of exploitation within 30 days. Do: Apply Adobe's security updates to Acrobat and Reader per vendor instructions, as required by the CISA KEV catalog, and identify any legacy or unmanaged PDF reader installs that no longer receive updates. Given the elevated EPSS score and KEV listing, prioritize patching high-value and frequently emailed endpoints, and review endpoint/mail-gateway telemetry for PDF-borne exploitation activity. | 8.8 | 36% | KEV |
| mass≈ hundreds of millions of users (Acrobat/Reader is the dominant desktop PDF reader; only unpatched builds are vulnerable) | |
| CVE-2018-8120 | Local Privilege Escalation in Microsoft Win32k (Windows 7 / Server 2008) CVE-2018-8120 is an elevation of privilege flaw in the Microsoft Windows Win32k kernel component, which fails to properly handle objects in memory. A local attacker who already has the ability to run code with low privileges on the machine must execute a specially crafted application that triggers the faulty object handling, allowing code to run in kernel mode. Successful exploitation yields elevated (SYSTEM-level) privileges and full control of the host, and it is commonly chained with a remote code execution or browser exploit, or used by malware — including ransomware — to deepen a compromise. Only systems running Windows 7, Windows Server 2008, or Windows Server 2008 R2 with unpatched Win32k are affected. The bug was exploited as a zero-day (reportedly by the ScarCruft APT group) before being fixed in May 2018 Patch Tuesday, a public PoC is available, and it was added to CISA's Known Exploited Vulnerabilities catalog in March 2022 with known ransomware use. Do: Apply Microsoft's May 2018 security updates or later cumulative updates for Windows 7, Windows Server 2008, and Windows Server 2008 R2, prioritizing this KEV-listed flaw per the CISA required action. Systems beyond end of support that are not receiving Extended Security Updates should be migrated to a supported Windows version or isolated, since they remain permanently exposed to known APT and ransomware tooling. Review hosts for signs of local privilege escalation and ensure any RCE entry vector (browser, file format, or service exploit) is also patched, as this bug is typically used to escalate an initial foothold. | 7.0 | 73% | KEV ransomware PoC |
| mass≈ hundreds of millions of Windows 7 desktops plus widespread Windows Server 2008/2008 R2 deployments worldwide |
Full article585 words · extracted from securityaffairs.com · click to collapse
Microsoft published technical details of 2 zero-days that have been recently discovered after someone uploaded a weaponized PDF file to VirusTotal.
Security researchers from Microsoft have published technical details of two zero-day vulnerabilities that have been recently discovered after someone uploaded a weaponized PDF file to VirusTotal.
The two issues were addressed by Microsoft with May 2018 Patch Tuesday before threat actors used it in attacks in the wild.
The first zero-day vulnerability is a remote code execution flaw in Adobe Acrobat and Reader (CVE-2018-4990), the second one is a privilege escalation flaw in Microsoft Windows (CVE-2018-8120).
“The first exploit attacks the Adobe JavaScript engine to run shellcode in the context of that module. The second exploit, which does not affect modern platforms like Windows 10, allows the shellcode to escape Adobe Reader sandbox and run with elevated privileges from Windows kernel memory. ESET provided an analysis of the exploitation routines in the sample PDF.” reads the analysis published by Microsoft.
Microsoft shared the technical details of both the flaw only now because it gave users enough time to update their operating systems and Adobe software.
In late March, experts at ESET analyzed a malicious PDF file that was uploaded on VirusTotal and provided it to the Microsoft security team.
The experts flagged the document “as a potential exploit for an unknown Windows kernel vulnerability.”
The analysis conducted by the Microsoft team revealed that the document includes two different zero-day exploits, one for Adobe Acrobat and Reader and one for Microsoft Windows.
According to Microsoft, the weaponized PDF file was in the early development stage, the code used by attackers appeared a PoC code and the weaponized file did not deliver a malicious payload.
“Although the PDF sample was found in VirusTotal, we have not observed actual attacks perpetrated using these exploits. The exploit was in early development stage, given the fact that the PDF itself did not deliver a malicious payload and appeared to be proof-of-concept (PoC) code.” reads the analysis published by Microsoft.
Someone combined the two zero-days to build a very powerful attack vector.
The Adobe Acrobat and Reader exploit is included in the document as a specially crafted JPEG 2000 image that contains the JavaScript exploit code used to trigger a double-free vulnerability in the software to run shellcode.
The attackers were trying to chain this exploit with the second Windows kernel exploit to break the Adobe Reader sandbox and run it with elevated privileges.
Once the attacker has exploited the Adobe Reader vulnerability, he will leverage the Window zero-day flaw to escape the sandbox. The Microsoft Win32k zero-day allows the attacker to elevate the privilege of the PE file to run, which is run in kernel mode, escaping the Adobe Acrobat/Reader sandbox and gaining system-level access.
The PoC payload used in the sample dropped an empty vbs file in the Startup folder.
“Initially, ESET researchers discovered the PDF sample when it was uploaded to a public repository of malicious samples. The sample does not contain a final payload, which may suggest that it was caught during its early development stages.” concluded ESET.
“Even though the sample does not contain a real malicious final payload, the author(s) demonstrated a high level of skills in vulnerability discovery and exploit writing.”
Both Microsoft and ESET published technical details of the two zero-days, both firms also shared the IoCs for the exploits.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – zero-days, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/74095/malware/zero-days-weaponized-pdf.html