Risk
2/18/2009
04:04 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Internet Explorer 7 Vulnerability Being Exploited

Cyber criminals are using a malicious Microsoft Word file distributed through spam to attack an exploit Microsoft patched last week.

US-CERT, the government's cybersecurity arm, is warning users of Microsoft Internet Explorer 7 about a Trend Micro report claiming that cybercriminals are attacking Internet Explorer 7 through a vulnerability disclosed and patched by Microsoft last week.

"Cybercriminals are actively exploiting a critical vulnerability in Internet Explorer 7, which arises from the browser's improper handling of errors when attempting to access deleted objects," said Trend Micro's Jake Soriano in a blog post on Tuesday. "This vulnerability allows remote attackers to execute arbitrary codes on a vulnerable machine."

Microsoft designated Security Bulletin MS09-002 to be "critical" and gave the vulnerability a score of 1 on its Exploitability Index, indicating that functioning exploit code was expected.

According to Trend Micro, the attack begins with a malicious Microsoft Word (.doc) file distributed through spam. It contains an ActiveX control that reaches out to a malicious site that exploits the vulnerability patched by MS09-002.

If the system attacked is unpatched, the ActiveX control, identified as HTML_DLOADER.AS, will download a secret back door, identified as BKDR_AGENT.XYMS, designed to steal information from the compromised system. It also takes screenshots of the affected system and sends these to a remote location, and it will listen for commands through a hidden Internet Explorer window.

"Although the install base of the IE family is slowly eaten up by stiff competition such as Firefox and Chrome, IE7 is used by about one in every four Web users, a much larger share than previous versions of IE," observes Soriano. "This could explain why cybercriminals seem to be eagerly searching for more bugs."


InformationWeek has published an in-depth report on overhauling Microsoft. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-4801
Published: 2014-12-18
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iFix 2, and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.