A Tale of 3 Vulnerabilities, CVE-2014-1776 Exploit Linked to Previous Attacks
Summary: Palo Alto Networks researchers determined that CVE-2014-1776, an Internet Explorer use-after-free bug affecting IE versions 6 through 11, was exploited in targeted attacks using an HTML page combined with a Flash file that builds the memory layout and triggers the flaw. The exploit's Flash code shares structures, variable names such as 's' and 'ss', a one-second Timer set to repeat for 4,096 seconds, and a Sound object named 'snd' with the earlier CVE-2013-3163 and CVE-2014-0322 exploits, leading the researchers to conclude the same author or group, or at least a common template, produced all three.
Key Takeaway: The bug reached every IE user from version 6 to 11, and Microsoft shipped patches for Windows XP even though support ended April 8, 2014 - a reminder that a single browser flaw can force an out-of-band patch for an unsupported platform. The reused code, down to leftover variables the attacker forgot to remove, shows one exploit kit or author can carry a working technique across three separate IE vulnerabilities.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2013-3163CVE-2014-0322CVE-2014-1776
- Related
- Addressing CVE-2014-6332 SWF Exploit Cyber Risks ·CVE-2013-3163: Microsoft Internet Explorer Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 30, 2023