Microsoft In-The-Wild Coverage - CVE-2012-1889 and CVE-2012
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-1889 | Memory Corruption RCE in Microsoft XML Core Services Microsoft XML Core Services (MSXML) contains a memory corruption flaw (CWE-119) that can allow remote code execution when the component processes attacker-crafted content, such as a malicious web page or XML document loaded through Internet Explorer. Successful exploitation lets an attacker run arbitrary code in the security context of the logged-on user, gaining the ability to install programs, and view, change, or delete data; an admin-context victim would yield full system compromise. Any Windows system shipping the affected MSXML components is affected, which at the time of disclosure meant essentially the entire Windows installed base. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-06-08, EPSS assigns it an 83.6% probability of exploitation in the next 30 days (top percentile), and related reporting ties it to observed in-the-wild and APT activity, though public ransomware association is listed as unknown. No public proof-of-concept is cataloged, but the KEV and EPSS signals indicate active, ongoing exploitation risk. Do: Apply the vendor updates for XML Core Services released in the July 2012 Patch Tuesday on all Windows systems, prioritizing internet-facing and legacy endpoints, per the CISA KEV required action. Because exploitation is triggered via crafted web/XML content, restrict or upgrade legacy Internet Explorer usage and block untrusted web content on affected hosts. Hunt for exploitation indicators given the 2022-06-08 KEV listing and high EPSS score, and verify MSXML-related patches are present in your patch inventory. | — | 84% | KEV |
| mass≈hundreds of millions of Windows endpoints (MSXML ships as a core Windows component) |
Full article484 words · extracted from blog.talosintelligence.com · click to collapse
Thursday, June 21, 2012 16:18
As a security professional, there's very little I hate more than Microsoft vulnerabilities announced after patches are sent out each Microsoft Tuesday. Not only do they mean that folks like me have to scramble to address them - since invariably bugs released outside the standard patch cycle come with live exploits - they typically grant the largest possible exploitation window to an attacker. If your job is to keep systems secure, a potentially month-long window between exploit code release and patch release is a nightmare.
This month brought that exact scenario, with the public release of CVE-2012-1889 mere hours after the release of the month's patches. The vulnerability has been actively exploited in the wild for some time before this public release; Google has been issuing warnings to potential victims in Gmail at least since June 5. Initial exploitation appears to have been very narrowly targeted; with the June 15 release of a Metasploit module, however, as well as other exploits appearing across the web, users should expect a much more broad target base for attackers.
The good news for those of us charged with keeping networks secure is that there's been a very rapid response to this particular attack. The VRT released SIDs 23142 - 23146 the day after the public release of the vulnerability; we have been continuously monitoring newly released attacks, and have found that those rules cover everything that has been released to date. As those signatures are extremely generic in relation to the vulnerability, we expect them to continue working for any new exploits that are created, public or private.
In addition, Microsoft released a "Fix It" tool the day of the vulnerability announcement. While this tool does not patch the underlying bug - they're actively working on creating that patch - it does block the attack from reaching the vulnerable section of their codebase, which effectively keeps users safe while a full patch is created. I would strongly encourage you to use this tool immediately.
The other bug from this month's patch cycle that's actively being exploited in the wild is CVE-2012-1875, a complex DOM manipulation bug in Internet Explorer. A functional exploit with shellcode appeared on PasteBin on June 8 - four days before the release of the patch by Microsoft - and Metasploit also released code on June 13, which has been under active development to work on more platforms ever since. While the initial exploitation appeared, once more, to be very narrowly targeted, the broad availability of functional exploit code today means that the likelihood of this attack appearing in exploit kits or other commoditized attack platforms is exceptionally high.
Sourcefire customers have been protected by SID 23125 since this month's Microsoft Tuesday release; again, this coverage has been verified across all known exploits in the wild, and will be continually reviewed as new tools are released.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-in-wild-coverage-cve-2012/