Internet Explorer use-after-free 0-Day vulnerability
Summary: A use-after-free vulnerability affects Internet Explorer 6, 7, 8 and 9 on Windows XP, Vista, 7, Windows Server 2003 and 2008, and was unpatched at the time of Cisco Talos's blog post. Eric Romang reported that the Nitro cybercriminal gang, which weeks earlier exploited the Java 0-day CVE-2012-4681, was hosting suspicious files, and running one produced code execution in the logged-in user's context on a fully patched Windows system.
Bottom line: A Metasploit module is already released and exploit information is widely available, so the window between discovery and weaponized attacks on unpatched IE installs is effectively closed. The same gang behind the Java 0-day is hosting the files, which means an exploit kit operator with a track record already has working code.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2012-4681
- Related
- CVE-2012-4681: bypassing built-in java security Cyber Risks ·Attackers Pounce on Zero-Day Java Exploit Cyber Risks ·CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022