MS09-002 exploit in-the-wild...

FYI…

- http://blog.trendmicro.com/another-exploit-targets-ie7-bug/
Feb. 17, 2009 - "Cybercriminals are actively exploiting a critical vulnerability in Internet Explorer 7, which arises from the browser’s improper handling of errors when attempting to access deleted objects. This vulnerability allows remote attackers to execute arbitrary codes on a vulnerable machine. The threat starts with a spammed malicious .DOC file detected as XML_DLOADR.A. This file has a very limited distribution script, suggesting it may be a targeted attack. It contains an ActiveX object that automatically accesses a site rigged with a malicious HTML detected by the Trend Micro Smart Protection Network as HTML_DLOADER.AS. HTML_DLOADER.AS exploits the CVE-2009-0075* vulnerability, which is already addressed by the MS09-002** security patch released last week. On an unpatched system though, successful exploitation by HTML_DLOADER.AS downloads a backdoor detected as BKDR_AGENT.XZMS. This backdoor further installs a .DLL file that has information stealing capabilities. It sends its stolen information to another URL via port 443… Our engineers are still working on the details of this threat. We will post updates as soon as more information becomes available…"
* http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2009-0075
Last revised: 02/17/2009

** http://www.microsoft.com/technet/security/…n/MS09-002.mspx

- http://isc.sans.org/diary.html?storyid=5884
Last Updated: 2009-02-17 19:55:10 UTC - "…there is absolutely nothing preventing attackers from using the exploit in a drive-by attack (and we can, unfortunately, expect that this will happen very soon)…"

- http://www.us-cert.gov/current/#malware_ex…ternet_explorer
February 17, 2009

<_<

FYI…

- http://vrt-sourcefire.blogspot.com/2009/02…02-in-wild.html
February 18, 2009 - "Yesterday we came across a website taking advantage of a programming error in Internet Explorer that allows a remote attacker to execute code on a vulnerable system. Microsoft issued an advisory (MS09-002) on February 10, 2009 and released a patched on the same day to mitigate the problem. We released same-day coverage for this and other vulnerabilities*… Upon visiting the compromised page with Internet Explorer 7 on a vulnerable machine, a malicious script is executed, which in turn downloads an executable on the system before crashing the web browser…
UPDATE: As of 11AM EST on Feb 19, 2009, another Chinese website is leveraging MS09-002 to push malware to victims…"
* http://www.snort.org/vrt/advisories/vrt-ru…2009-02-10.html

'Better known as "Drive-by malware"…

<_<

FYI…

Cumulative Security Update for Internet Explorer - Extreme Severity
- http://atlas.arbor.net/briefs/
February 23, 2009 - "…key issues to address for -all- users of IE7. We have seen this used in targeted attacks and now exploit kits that target indiscriminately."
* http://www.microsoft.com/technet/security/…n/ms09-002.mspx