Two Zero-Day Exploits Found After Someone Uploaded 'Unarmed' PoC to VirusTotal
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-4990 | Double Free RCE in Adobe Acrobat and Reader CVE-2018-4990 is a double free (CWE-415) memory-corruption vulnerability in Adobe Acrobat and Reader, in which the application frees the same memory allocation twice while handling a crafted PDF document. An attacker who convinces a user on a vulnerable build to open a malicious PDF (e.g., via email attachment or web download) can corrupt heap memory and achieve remote code execution in the context of the logged-in user. Anyone running vulnerable releases of Adobe Acrobat or Reader is affected; the provided data does not enumerate specific version ranges, so unpatched builds from the disclosure era should be treated as potentially vulnerable. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08), confirming exploitation in the wild; no public proof-of-concept is known, ransomware association is unknown, and EPSS assigns a high 36.6% probability of exploitation within 30 days. Do: Apply Adobe's security updates to Acrobat and Reader per vendor instructions, as required by the CISA KEV catalog, and identify any legacy or unmanaged PDF reader installs that no longer receive updates. Given the elevated EPSS score and KEV listing, prioritize patching high-value and frequently emailed endpoints, and review endpoint/mail-gateway telemetry for PDF-borne exploitation activity. | 8.8 | 36% | KEV |
| mass≈ hundreds of millions of users (Acrobat/Reader is the dominant desktop PDF reader; only unpatched builds are vulnerable) | |
| CVE-2018-8120 | Local Privilege Escalation in Microsoft Win32k (Windows 7 / Server 2008) CVE-2018-8120 is an elevation of privilege flaw in the Microsoft Windows Win32k kernel component, which fails to properly handle objects in memory. A local attacker who already has the ability to run code with low privileges on the machine must execute a specially crafted application that triggers the faulty object handling, allowing code to run in kernel mode. Successful exploitation yields elevated (SYSTEM-level) privileges and full control of the host, and it is commonly chained with a remote code execution or browser exploit, or used by malware — including ransomware — to deepen a compromise. Only systems running Windows 7, Windows Server 2008, or Windows Server 2008 R2 with unpatched Win32k are affected. The bug was exploited as a zero-day (reportedly by the ScarCruft APT group) before being fixed in May 2018 Patch Tuesday, a public PoC is available, and it was added to CISA's Known Exploited Vulnerabilities catalog in March 2022 with known ransomware use. Do: Apply Microsoft's May 2018 security updates or later cumulative updates for Windows 7, Windows Server 2008, and Windows Server 2008 R2, prioritizing this KEV-listed flaw per the CISA required action. Systems beyond end of support that are not receiving Extended Security Updates should be migrated to a supported Windows version or isolated, since they remain permanently exposed to known APT and ransomware tooling. Review hosts for signs of local privilege escalation and ensure any RCE entry vector (browser, file format, or service exploit) is also patched, as this bug is typically used to escalate an initial foothold. | 7.0 | 73% | KEV ransomware PoC |
| mass≈ hundreds of millions of Windows 7 desktops plus widespread Windows Server 2008/2008 R2 deployments worldwide |
Full article505 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalJul 02, 2018
Security researchers at Microsoft have unveiled details of two critical and important zero-day vulnerabilities that had recently been discovered after someone uploaded a malicious PDF file to VirusTotal, and get patched before being used in the wild.
In late March, researchers at ESET found a malicious PDF file on VirusTotal, which they shared with the security team at Microsoft "as a potential exploit for an unknown Windows kernel vulnerability."
After analyzing the malicious PDF file, the Microsoft team found that the same file includes two different zero-day exploits—one for Adobe Acrobat and Reader, and the other targeting Microsoft Windows.
Since the patches for both the vulnerabilities were released in the second week of May, Microsoft released details of both the vulnerabilities today, after giving users enough time to update their vulnerable operating systems and Adobe software.
According to the researchers, the malicious PDF including both the zero-days exploit was in the early development stage, "given the fact that the PDF itself did not deliver a malicious payload and appeared to be proof-of-concept (PoC) code."
It seems someone who could have combined both the zero-days to build an extremely powerful cyber weapon had unintentionally and mistakenly lost the game by uploading his/her under-development exploit to VirusTotal.
The zero-day vulnerabilities in question are a remote code execution flaw in Adobe Acrobat and Reader (CVE-2018-4990) and a privilege escalation bug in Microsoft Windows (CVE-2018-8120).
"The first exploit attacks the Adobe JavaScript engine to run shellcode in the context of that module," Matt Oh, Security Engineer at Windows Defender ATP Research, says.
"The second exploit, which does not affect modern platforms like Windows 10, allows the shellcode to escape Adobe Reader sandbox and run with elevated privileges from Windows kernel memory."
The Adobe Acrobat and Reader exploit was incorporated in a PDF document as a maliciously crafted JPEG 2000 image containing the JavaScript exploit code, which triggers a double-free vulnerability in the software to run shellcode.
Leveraging shellcode execution from the first vulnerability, the attacker uses the second Windows kernel exploit to break the Adobe Reader sandbox and run it with elevated privileges.
Since this malicious PDF sample was under development at the time of detection, it apparently included a simple PoC payload that dropped an empty vbs file in the Startup folder.
"Initially, ESET researchers discovered the PDF sample when it was uploaded to a public repository of malicious samples," ESET researchers concluded.
"The sample does not contain a final payload, which may suggest that it was caught during its early development stages. Even though the sample does not contain a real malicious final payload, the author(s) demonstrated a high level of skills in vulnerability discovery and exploit writing."
Microsoft and Adobe have since released corresponding security updates for both the vulnerabilities in May. For more technical details of the exploits, you can head on to Microsoft and ESET blogs.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2018/07/windows-adobe-zero-exploit.html