Vulnerabilities / Threats
11/8/2013
12:43 PM
50%
50%

Criminals Exploit Microsoft Office Zero-Day Flaw

At least two sets of attackers have been using malicious Office documents to exploit the graphics processing vulnerability.

Windows 8.1: A Visual Tour
Windows 8.1: Visual Tour
(click image for larger view)
Warning: Attacks against a zero-day vulnerability in Microsoft Office are more extensive than first believed. That finding further reinforces security experts' recommendation that businesses install an emergency mitigation technique released by Microsoft as quickly as possible.

At least two different criminal groups appear to have been successfully targeting the zero-day bug, using malicious Office documents. The flaw has been traced to a remote-code execution vulnerability in Microsoft graphics functionality that handles the TIFF file format.

What's the risk? "An attacker could exploit this vulnerability by convincing a user to preview or open a specially crafted email message, open a specially crafted file, or browse specially crafted Web content," according to a Microsoft security advisory. "An attacker who successfully exploited the vulnerability could gain the same user rights as the current user," and execute arbitrary code or install malware.

[ Do you still use Windows XP? Read Windows XP Security Apocalypse: Prepare To Be Pwned. ]

Pending a patch, Microsoft has released an emergency "Fix it" that fully mitigates the vulnerability. Given the lack of lead time, security experts don't expect a patch for the zero-day vulnerability -- discovered this week -- to be ready for inclusion in this month's regularly scheduled Microsoft patch release, which is due to happen Tuesday.

To date, related attacks have targeted users of Microsoft Office 2003, 2007 and 2010, and targeted organizations have reportedly received booby-trapped Office documents. The graphics vulnerability is being exploited in a novel way: "We found the DEP status was 'on' at the process start but 'off' during shellcode execution,'" said Vinay Karecha, a McAfee Labs researcher, in a teardown of exploit code that refers to the advanced attack mitigation attack known as data execution prevention, which together with address space layout randomization (ASLR) has made Windows much more difficult for malware-writers to exploit.

"Our analyzed exploit didn't bypass ASLR and DEP," said Karecha. "Instead, it leveraged a backward-compatibility feature in Office 2007 to disable DEP. Without DEP, ASLR is quite easy to bypass."

According to FireEye researcher Mike Scott, one of the two groups that's been exploiting this zero-day vulnerability appears to be operating from India. "Our analysis has revealed a connection between these attacks and those previously documented in Operation Hangover, which adds India and Pakistan into the mix of targets," he said in a blog post. "Information obtained from a command-and-control server (CnC) used in recent attacks leveraging this zero-day exploit revealed that the Hangover group, believed to operate from India, has compromised 78 computers, 47 percent of those in Pakistan."

Norwegian security software vendor Norman was the first to highlight Operation Hangover in May, saying the Hangover group had been launching advanced persistent threat (APT) attacks since at least 2010. Norman also found multiple references in the malware code to Indian information security software and "ethical hacking" vendor Appin. Some security experts alleged that was a smoking gun that tied the APT attacks to Appin, and that the Hangover group's list of government targets in Pakistan suggests the Indian government might have commissioned the attacks. But Appin has continued to vigorously deny that it had any role in the attacks.

A second group, meanwhile, has been using the Microsoft graphics vulnerability to infect targeted PCs with Citadel malware, which is designed to steal financial information. "This group, which we call the Arx group, may have had access to the exploit before the Hangover group did," said FireEye's Scott. "Information obtained from CnCs operated by the Arx group revealed that 619 targets (4,024 unique IP addresses) have been compromised. The majority of the targets are in India (63%) and Pakistan (19%)."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0176
Published: 2015-04-27
Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response.

CVE-2015-1886
Published: 2015-04-27
The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.