IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch

A critical memory corruption vulnerability in Internet Explorer versions 7 through 11 that Microsoft released an emergency patch for yesterday is being used in watering hole and spearphishing attacks. Successful exploitation enables remote code execution and grants the attacker the same privileges as the current user.

The vulnerability, CVE-2015-2502, is a memory corruption bug, exploited by a hacker either hosting a malicious website or running malicious content on a legitimate site.

The attack seen in the wild has been using a malicious IFrame and drops a variant of the PlugX remote access Trojan, which calls a command-and-control server based in Korea, according to Heimdal Security.

“The recently exposed flaw does allow remote code execution so it is in a class that is pretty serious," says Cris Thomas, strategist at Tenable Network Security. "The key here though, and the reason why Microsoft issued an out-of-band patch, isn't because this bug is super bad, but because bad guys are using this bug right now to break into people’s systems. However, Microsoft hasn't released any information with regards to how extensive that usage is. It is possible that this issue is only being used in selective, highly targeted attacks or it could be in widespread use on a botnet or third party web advertising network.

"Unfortunately, there are no work-arounds for this bug. Ensuring that you have Microsoft's Enhanced Mitigation Experience Toolkit configured will make exploiting this bug more difficult, but not impossible."