Microsoft has issued a security advisory that describes a vulnerability in its XML module. McAfee has also observed that the vulnerability is being actively exploited in the wild. The vulnerability exists when the function “msxml3!_dispatchImpl::InvokeHelper” in Microsoft’s XML attempts to access an object in memory that has not been initialized, allowing attacker to execute arbitrary code.
Metasploit has released an exploit module for this vulnerability. We have modified the Metasploit-generated HTML exploit to locate the vulnerability and observed the crash in the msxml module in Internet Explorer. The following code crashes IE.
Windbg shows Internet Explorer crash
Investigating the crash reveals that the flaw exists in the function “msxml3!_dispatchImpl::InvokeHelper,” which attempts to access an uninitialized local variable as shown in the following image.
The vulnerable function
This flaw allows an attacker to control the execution of the program and transfer the control to the malicious shellcode.
Execution transferred to the shellcode
After gaining control, the malicious process decrypts the shellcode and downloads a malicious file from a remote server.
Decrypting the URL
We have also observed that the attack is carried out by injecting the malicious URL through an iframe. We advise caution while opening unsolicited emails and unknown links. McAfee detects these exploits as “Exploit-CVE-2012-1889.” However, we strongly recommend installing the Microsoft patch to stay protected.
Thanks to my colleagues Varadharajan Krishnasamy and Sujit Ghosal for their valuable contributions.
Leave a reply
