Vulnerability in Microsoft XML Core Services Opens Door to AttackersMicrosoft has issued a security advisory that describes a vulnerability in its XML module. McAfee has also observed that the vulnerability is being actively exploited in the wild. The vulnerability exists when the function “msxml3!_dispatchImpl::InvokeHelper” in Microsoft’s XML attempts to access an object in memory that has not been initialized, allowing attacker to execute arbitrary code.
Metasploit has released an exploit module for this vulnerability. We have modified the Metasploit-generated HTML exploit to locate the vulnerability and observed the crash in the msxml module in Internet Explorer. The following code crashes IE.
Larger PictureWindbg shows Internet Explorer crash
Investigating the crash reveals that the flaw exists in the function “msxml3!_dispatchImpl::InvokeHelper,” which attempts to access an uninitialized local variable as shown in the following image.
Larger PictureThe vulnerable function
This flaw allows an attacker to control the execution of the program and transfer the control to the malicious shellcode.
Larger PictureExecution transferred to the shellcode
After gaining control, the malicious process decrypts the shellcode and downloads a malicious file from a remote server.
Larger PictureDecrypting the URL
We have also observed that the attack is carried out by injecting the malicious URL through an iframe. We advise caution while opening unsolicited emails and unknown links. McAfee detects these exploits as “Exploit-CVE-2012-1889.” However, we strongly recommend installing the
Microsoft patch to stay protected.
Thanks to my colleagues
Varadharajan Krishnasamy and
Sujit Ghosal for their valuable contributions.
Orginal article: Monday, June 25, 2012 at 3:11pm by Abhijit Mohanta
Total Members: 14197
Topic: Vulnerability in Microsoft XML Core Services Opens Door to Attackers (Read 2199 times)
