It's not the Dalai Lama's birthday, oh and you got owned

Summary: Cisco Talos researchers Alain Zidouemba and others found targeted attack campaigns tied to the Dalai Lama, including purported plans for his birthday and calls for democracy in Tibet, using exploits such as CVE-2012-0158, a bug in the Mscomctl ActiveX control patched in April. The latest samples dropped the surrounding stream-header and listview/treeview structures, keeping only the vulnerable record with an overflowed value, so the file still delivers the attack with a smaller detection footprint and causes MS Office to crash and reopen to recover the file.
Bottom line: Talos had to rewrite its detection because the old signatures, which looked perfectly valid against exploits originally seen in the wild, would have missed these stripped-down samples - a reminder that a signature matching yesterday's exploit can sit green while a working variant slips past.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2012-0158
Related: CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains Cyber Risks ·
CVE-2014-1761, Oh did you mean CVE-2012-2539? Cyber Risks ·