Addressing CVE-2014-6332 SWF Exploit
Summary: Unit 42 reported that SWF samples purportedly used with the Internet Explorer vulnerability CVE-2014-6332 had appeared in several places, though the researchers had not encountered the SWF with its original exploit attached. The Flash component's shellcode resolves NtSetContextThread via GetProcAddress, overrides debug registers to eliminate EMET's EAF feature, then reads a payload PE delivered as "shadow.jpg" and writes it to windump.exe in the Local\Temp directory.
Why it matters: This is described as the first in-the-wild attack targeting machines protected by EMET, specifically EMET 4.1 - and although the bypass is unfinished and would be caught by EMET's stack pivot check on VirtualAlloc, disabling that single test would let it succeed, and a fairly small set of customizations could extend it to EMET 5.1.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-0322CVE-2014-1776CVE-2014-6332
- Related