- http://www.eweek.com/article2/0,1759,20174…3129TX1K0000614
September 18, 2006
"Security researchers at Sunbelt Software have discovered an active malware attack against fully patched versions of Microsoft's Internet Explorer browser. The exploit has been seeded at several porn sites hosted in Russia and is being used to launch drive-by malware downloads that appear to be hijacking Windows machines for use in botnets. eWEEK has confirmed the flaw—and zero-day attacks—and on a fully patched version of Windows XP SP2 running IE 6.0. There are at least three different sites hosting the malicious executables, which are being served up on a rotational basis. According to Eric Sites, vice president of research and development at Florida-based Sunbelt Software, the vulnerability is a buffer overflow in the way the world's most widely used browser handles VML (Vector Markup Language) code. The attack is linked to the WebAttacker, a do-it-yourself malware installation toolkit that is sold at multiple underground Web sites. "Once you click on the site, the exploit opens a denial-of-service box and starts installing spyware," Sites said. He said the exploit can be mitigated by turning off JavaScript in the browser…"
- http://sunbeltblog.blogspot.com/2006/09/se…loit-being.html
- http://secunia.com/advisories/21989/
Release Date: 2006-09-19
Critical: Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Software: Microsoft Internet Explorer 6.x
…Successful exploitation allows execution of arbitrary code.
NOTE: Reportedly, this is currently being exploited in the wild.
The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. Other versions may also be affected.
Solution:
Do not visit untrusted web sites.
Deactivating Active Scripting will prevent exploitation using the currently known exploit…"
- http://blog.washingtonpost.com/securityfix…ploit_spel.html
September 18, 2006; 10:25 PM ET
"…If past experience with new IE exploits holds true, we may soon see this exploit being sewn into the fabric of legitimate, but poorly programmed, business Web sites that hackers can manipulate to their advantage… Among the nasty pieces of software an IE user can expect to be whacked with upon visiting one of the sites is the BigBlue keystroke logger, which monitors and captures data from computers including screenshots, keystrokes, web cam and microphone data; it also records instant messaging chat sessions, e-mail information and the Web sites visited by the user. The exploit is also being used to install the incredibly invasive Spybot worm and VXGame Trojan, as well as adware titles that scam artists profit from on a per installation basis, such as Virtumondo, SafeSurfing, Avenue Media, WebHancer, Internet Optimizer, SurfSidekick, DollarRevenue, and the bogus anti-spyware program SpySheriff…"
- http://www.symantec.com/enterprise/securit…day_exploi.html
September 19, 2006
"…We have confirmed that this exploit takes advantage of a bug in VML (Vector Markup Language, which is an XML language used to produce vector graphics) to overflow a buffer and inject shell code. The exploit then downloads and installs multiple Security Risks, such as spyware, on the compromised machine… Although Microsoft has already been informed, at the time of writing there is no patch available for this particular exploit. Mitigating strategies include disabling JavaScript in Internet Explorer and using non-vulnerable browsers…"
> http://www.symantec.com/enterprise/securit…-091914-1801-99
Microsoft Security Advisory (925568)
Vulnerability in Vector Markup Language Could Allow Remote Code Execution
- http://www.microsoft.com/technet/security/…ory/925568.mspx
Published: September 19, 2006
"Microsoft has confirmed new public reports of a vulnerability in the Microsoft Windows implementation of Vector Markup Language (VML) Microsoft is also aware of the public release of detailed exploit code that could be used to exploit this vulnerability. Based on our investigation, this exploit code could allow an attacker to execute arbitrary code on the user's system. Microsoft is aware that this vulnerability is being actively exploited. A security update to address this vulnerability is now being finalized through testing to ensure quality and application compatibility Microsoft’s goal is to release the update on Tuesday, October 10, 2006, or sooner depending on customer needs…
Workarounds -
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified…"
- http://www.websense.com/securitylabs/blog/blog.php?BlogID=81
Sep 20 2006
"The recently reported VML Internet Explorer "zero-day" exploit now has attack code publicly posted on the web. Although the first version results in a denial of service and not escalated privileges, we expect to see public posts of exploit code that does allows a user to run code without user-interaction. This may result in increased attacks based on the fact that there are no patches available and often "copy-cat" attacks that simply cut and paste P.O.C. code often occur after public release."
More VML exploits released
- http://www.websense.com/securitylabs/alert…php?AlertID=632
September 21, 2006
"…We are seeing the addition of payload code that includes Trojan Horse Backdoors and code which is designed to steal information from the end-user or their machines (i.e. Crimeware)… In addition, reports out of Australia CERT (see: http://www.auscert.org.au/render.html?it=6771 ) are that attacks are surfacing through emails with URL lures. We have confirmed this to be true and that this is using a modified version of the Web Attacker Toolkit… we have some examples of sites that are distributing the code or are pointing to sites that are distributing the code…"
Updated: Microsoft Security Advisory (925568)
Vulnerability in Vector Markup Language Could Allow Remote Code Execution
- http://www.microsoft.com/technet/security/…ory/925568.mspx
"• September 21, 2006: Advisory updated with new CVE reference, un-register vgx.dll workaround updated, and Outlook Express mitigation added." (Use the URL above to review updated detail.)
(InfoCon level to yellow) - MSIE VML exploit spreading
- http://isc.sans.org/diary.php?storyid=1727
Last Updated: 2006-09-22 15:09:18 UTC
"The VML exploit is now becoming more widespread, so we changed the InfoCon level to yellow to emphasize the need to consider fixes. If you have not taken measures yet, please consider some emergency fixes to cover the weekend (especially for those laptops surfing the web from home; they might be at high risk). The exploit is widely known, easy to recreate, and used in more and more mainstream websites. The risk of getting hit is increasing significantly. Outlook (including outlook 2003) is - as expected - also vulnerable and the email vector is being reported as exploited in the wild as well. Weekends are moreover popular moments in time for the bad guys to build their botnets…"
(Recommended action and other references available at the ISC URL above.)
- http://www.techweb.com/article/printableAr…_section=700028
September 22, 2006
"…Pressure on Microsoft to fix the flaw may be mounting, said other security professionals, who have noticed increased attack activity. "VML attacks have ramped up significantly in the past 24 hours," said Ken Dunham, director of iDefense's rapid response team, in an e-mail to TechWeb. "At least one domain hosts provider has suffered a large-scale attack leading to index file modifications on over 500 domains to redirect users to a hostile VML exploiting site," Dunham continued. Eric Sites, vice president of research and development at Sunbelt Software, which first reported the vulnerability and exploit earlier this week, also said that attacks were "definitely escalating." In a conversation with a tier 1 support representative at Cox Cable on Friday, Sites said, he was told that the cable operator had several thousand support calls and e-mails backed up, with users reporting a wide variety of complaints, including IE crashes. "That may be a targeted attack," said Sites. Both Dunham and Sites warned of even larger attacks over the weekend. "[Users should] implement a workaround ASAP due to imminent global attacks," said Dunham. "There are a lot more sites using [a VML exploit]," added Sites. Part of their concern is that the exploit may quickly move to e-mail, with spam-style attacks compromising PCs as soon as the recipient views an infected message in an HTML preview pane. Symantec, for example, confirmed Friday that a working exploit against Microsoft Outlook has been written and posted by Immunity Inc. for its CANVAS exploit framework.
An e-mailed attack is dangerous because it requires no out-of-the-ordinary user action, said Sites. "If you see a message in the Preview Pane or double click it, a well-crafted exploit will crash Outlook. You won't see any error message." As soon as that happens, the attacker can begin loading a user's PC with adware, spyware, and other malicious code, he added…"
VML exploits with OS version detection
- http://isc.sans.org/diary.php?storyid=1733
Last Updated: 2006-09-24 20:46:46 UTC
"We are seeing samples of the VML exploit that are coded to include browser / OS detection, and are able to trigger working exploits for Win 2000, 2003 and XP. Some reports indicate that client-side anti-virus is not sufficient to protect, some AV apparently only catches the VML exploit code once Internet Explorer writes the temp file to disk, which can be too late. The exploits versions seen so far usually pull and run an EXE file, but adding patterns for new EXE payloads is an arms race the AV vendors can't win. If you have the option, we suggest you use the work around of unregistering the DLL as indicated in our earlier diary entry*."
* http://isc.sans.org/diary.php?storyid=1727
Email Lures to VML Exploits
- http://www.websense.com/securitylabs/alert…php?AlertID=633
September 25, 2006
"We are starting to see mass mailing lures for websites that are hosting VML exploit code. Most of the sites are using updated Web-Attacker code. A recent example that came to us from Message Labs appears to lure users to the site by claiming they have received a Yahoo! Greeting Card. The site downloads and installs an Internet Explorer Browser Helper Object that directs all HTTP posts from forms to a third party, and then collects information on end-users…"
