1 min
Nexpose
CVE-2017-3823: Remote Code Execution Vulnerability in Cisco WebEx Browser Plugin
On January 21st 2017, Google's Project Zero disclosed a vulnerability in Cisco's
WebEx browser plugin extension that could allow attackers to perform a remote
code execution (RCE) exploit on any Windows host running the plugin.
An initial fix was pushed out by Cisco that warned a user if they were launching
a meeting from a domain other than *.webex.com or *.webex.com.cn, however, the
fix was questioned by April King from Mozilla
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1096#c
13 min
Metasploit
Using Reflective DLL Injection to exploit IE Elevation Policies
As you are probably aware, sandbox bypasses are becoming a MUST when exploiting
desktop applications such as Internet Explorer. One interesting class of sandbox
bypasses abuse IE's Elevation Policies. An example of this type of sandbox
bypass is CVE-2015-0016
[http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0016]. The
vulnerability has already been analyzed by Henry Li, who published a complete
description in this blog entry
[http://blog.trendmicro.com/trendlabs-security-intelligence/
2 min
Microsoft
Patch Tuesday - September 2014
It's a light round of Microsoft Patching this month. Only four advisories, of
which only one is critical. The sole critical issue this month is the expected
Internet Explorer roll up affecting all supported (and likely some unsupported)
versions. This IE roll up addresses 36 privately disclosed Remote Code
Execution issues and 1 publically disclosed Information Disclosure issue which
is under limited attack in the wild. This will be the top patching priority for
this month.
Of the three no
1 min
Microsoft
August Patch Tuesday
Microsoft clearly wants everyone to shake off the dog days of summer and pay
attention to patching. This month's advance notice contains nine advisories
spanning a range of MSFT products. We have the ubiquitous Internet Explorer all
supported versions patch (MS14-051), with the same likely caveat that this would
apply to Windows XP too, if Microsoft still supported it. This patch addresses
the sole vulnerability to be actively exploited in the wild from in this month's
crop of issues, CVE-201
2 min
Microsoft
Patch Tuesday, June 2014
Patch Tuesday, June 2014 delivers seven advisories, of them, two critical, five
important – one of which is the seldom seen “tampering” type.
The remarkable item in this month's advisories is MS14-035, the Internet
Explorer patch affecting all supported versions. That in itself is not unique,
we see one of these almost every month, but this time the patch addresses 59
CVEs, that is 59 distinct vulnerabilities in one patch! Microsoft asserts that
while two of the vulnerabilities (CVE-2014-1770
3 min
Microsoft
Patch Tuesday, May 2014 - Lots going on
There is a lot going on in the updates from Microsoft this month, including some
very interesting and long time coming changes. Also, it's the highest volume of
advisories so far this year, with eight dropping on us, two of which are
labelled as critical.
How to describe the patching priority is going to be very subjective. Microsoft
has identified three of these advisories: MS14-024, MS14-025, & MS14-029, the IE
patch as priority 1 patching concerns. Interestingly MS14-029 which is the
update
1 min
Internet Explorer
Are your users exposed to IE 0-Day? Find out who is still using IE in your organization
As many security professionals, you probably sent an email to your users in the
last couple of days asking them NOT to use Internet Explorer as their browser in
light of the latest IE Zero Day vulnerability
[http://www.pcworld.com/article/2148368/new-internet-explorer-zero-day-puts-web-at-risk-and-xp-isnt-getting-a-fix.html]
.
However, you may be lacking visibility to user behavior, finding it hard to
observe if users actually follow your guidelines and indeed stop using Internet
Explorer as t
3 min
Exploits
If you lived here, you'd be home now - thoughts on an IE 0-day
Growing up around Boston, I remember seeing the famous billboards for the
Charles River Park apartments: "If You Lived Here, You'd Be Home Now". These
signs were placed strategically, almost sadistically, on Storrow Drive where
they were seen every day by the thousands of motorists trapped in rush hour
gridlock. This morning, as IT departments scrambled to react to the Internet
Explorer 0day vulnerability, I couldn't help but think about that devilish piece
of advertising.
This critical vuln
1 min
Nexpose
IE 0-day, we got you covered
News broke
[http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html]
this weekend of yet another IE 0-day under ("limited, targeted") exploitation in
the wild. Microsoft responded
[https://technet.microsoft.com/en-US/library/security/2963983] with an advisory,
but no patches yet. Given that the risk from the known exploit is mitigated by
the usual defence in depth tactics
[https://technet.mic
1 min
Microsoft
Patch Tuesday - March 2014
Microsoft's March Patch Tuesday again came in on the lighter side of some
months. This continues the 2014 trend of smaller Patch Tuesdays. We only see 2
issues that are critical/remote code execution, one of which is the usual IE
(MS14-012), the other is an an issue in the DirectShow libraries (MS14-013)
which affects most versions of Windows from XP up to 8.1/2012r2. These two are
where we should focus our patching efforts.
Of the 18 CVEs addressed in MS14-012, one is known to be in limit
2 min
Microsoft
Patch Tuesday October 2013
It's been an interesting month for the Microsoft Security watchers of the world.
If your job depends on securing systems running Windows, you should be eagerly
awaiting the patch for the Internet Explorer (IE) 0-day (CVE-2013-3893:
SetMouseCapture Use-After-Free) vulnerability in today's Patch Tuesday
(MS13-080). Exploitation of this vulnerability was detected first in targeted,
regionally restricted exploitation, and then later in broader use once the
exploit code spread to various public sites
4 min
Internet Explorer
Weekly Update: MSIE Exploit Disclosure, new CMDStager, and unattended.xml snarfing
MSIE exploit for CVE-2013-3893
This week, you might have seen some press
[https://community.rapid7.com/blog/www.eweek.com/security/microsoft-ie-zero-day-flaw-exposure-widens.html]
on our new exploit for CVE-2013-3893, some of which engages in that favorite
infosec dichotomy of full disclosure vs "responsible" disclosure. First, if you
want some technical details on the exploit development process used by our own
Wei @_sinn3r [https://twitter.com/_sinn3r] Chen, the bop on over to his blog
post o
2 min
Internet Explorer
IE 0-day: exploit code is now widely available (CVE-2013-3893)
Any newly discovered Internet Explorer zero day vulnerability is bad for users.
But once the exploit code gets around to public disclosure sites, it's so much
worse. In the past day or so exploit code has been submitted to virustotal.com
and scumware.org.
Users and administrators should take immediate action to mitigate the risk posed
by CVE-2013-3893
[http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3893]. Considering
the timing, I personally expect to see an out of band patch fro
3 min
Exploits
Department of Labor IE 0-day Exploit (CVE-2013-1347) Now Available at Metasploit
Recently, the U.S. Department of Labor website was compromised
[http://www.eweek.com/security/zero-day-exploit-enabled-cyber-attack-on-us-labor-department/]
and had been serving malicious code, capable of detecting and disabling some
antivirus products such as Avira, F-Secure, Kaspersky, AVG, Sophos, etc. It
would also attack Internet Explorer 8 users with an 0-day exploit. The
Metasploit vulnerability research community was particularly interested in the
exploit part, therefore that's what w
2 min
Metasploit
Weekly Metasploit Update: MSIE and Poison Ivy Returns
Yo Dawg, I Heard You Like 0-Day
As you may have heard, on Monday we rolled out a special update to Metasploit to
include the new Internet Explorer use-after-free exploit, aka, CVE-2012-4969
[http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4969]. Last night,
while scrolling through my RSS feed for security news, I saw this NetworkWorld
story [http://www.networkworld.com/community/node/81423] about how someone is
using this vulnerability to install Poison Ivy, a RAT / backdoor. Of course,