A new variant of Asruex Trojan exploits very old Office, Adobe flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-2883 | Stack-Based Buffer Overflow in Adobe Acrobat and Reader Allows RCE CVE-2010-2883 is a stack-based buffer overflow (CWE-119) in Adobe Acrobat and Adobe Reader that can be triggered remotely, for example by opening attacker-supplied PDF content. Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the local user, or to crash the application and cause a denial of service. Anyone running a vulnerable build of Adobe Acrobat or Reader is affected, and this flaw is one of the long-lived 'old Adobe flaws' that malware campaigns have been observed leveraging, as reflected in related reporting on an Asruex Trojan variant and the Spring Dragon APT. Exploitation status is significant for a vulnerability of this age: it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08, required action: apply updates per vendor instructions), EPSS assigns an 82.5% probability of exploitation within 30 days (100th percentile), and no public proof-of-concept is currently cataloged; ransomware use is unknown. Do: Apply vendor updates per Adobe's instructions, as required by CISA's KEV listing, and upgrade all Acrobat and Reader installations to a currently patched release. Inventory endpoints for legacy or unsupported Adobe Reader/Acrobat builds and prioritize patching for users who routinely handle untrusted PDFs. Until patched, treat unsolicited PDF attachments with caution and verify sender authenticity; no public PoC is known, but active exploitation is cataloged. | — | 82% | KEV |
| masshundreds of millions of desktop installs (Adobe Reader/Acrobat historically ubiquitous on enterprise and consumer systems) | |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days. Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching. | — | 100% | KEV ransomware |
| masshundreds of millions of Windows systems potentially affected |
Full article494 words · extracted from securityaffairs.com · click to collapse
Experts at Trend Micro discovered a new variant of the Asruex Trojan that exploits old Microsoft Office and Adobe vulnerabilities to infect systems.
Malware researchers at Trend Micro discovered a new variant of the Asruex Trojan that exploits old Microsoft Office and Adobe vulnerabilities to infect Windows and Mac systems.
Asruex first appeared in the threat landscape 2015, researchers linked it to the spyware used by the DarkHotel APT group.
“However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.” reads the report published by Trend Micro.
CVE-2012-0158 is a critical remote code execution (RCE) vulnerability that affected Microsoft Office.
CVE-2010-2883 is a stack buffer overflow flaw that could be exploited by attackers to execute arbitrary code or trigger a denial of service condition.
The attack chain leverages a shortcut file that has a PowerShell download script, and spreads through removable drives and network drives.
The use of exploits for well-known vulnerabilities that have been already patched suggests that attackers aims at infect specific targets who have been using older versions of Adobe Reader (versions 9.x up to before 9.4) and Acrobat (versions 8.x up to before 8.2.5) on Windows and Mac OS X.
Because of this unique infection capability, security researchers might not consider checking files for an Asruex infection and continue to watch out for its backdoor abilities exclusively. Awareness of this new infection method could help users defend against the malware variant.
Trend Micro researchers discovered the new Asruex variant in malicious .PDF files that was spread via phishing messages.
Researchers reported that attackers also used weaponized Word files to deliver the Asruex Trojan, in other cases the malicious code is delivered as a standard executable.
“This Asruex variant compresses and encrypts the original executable file or host file and appends it as its .EBSS section. This allows the malware to drop the infector, while also executing the host file like normal.” continues the report.
Once executed on a machine, Asruex will check the following information to determine if it is running in a sandbox environment:
- Computer names and user names
- Exported functions by loaded modules
- File names
- Running processes
- Module version of running process
- Certain strings in disk names
If the systems passes the checks, the backdoor is installed on the system.
“This case is notable for its use of vulnerabilities that have been discovered (and patched) over five years ago, when we’ve been seeing this malware variant in the wild for only a year,” Trend Micro concludes. “This hints that the cybercriminals behind it had devised the variant knowing that users have not yet patched or updated to newer versions of the Adobe Acrobat and Adobe Reader software.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Asruex Trojan, malware)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/90275/malware/asruex-trojan-old-flaws.html