Seen in the wild: Zero Day exploit being used to infect PCs

Our security research team has observed a new zero day exploit being used to infect systems. Coming from a porn website, this particular one is a vulnerability in VML inside of Internet Explorer.

On a sample Vmware, the following behavior was observed:

The machine was fully patched —

http www sunbelt software com ihs alex screen1vmlexploit thumb jpg

And just to double-check, we ran an MBSA scan which confirmed the box as fully patched:

http www sunbelt software com ihs alex securityscan0000012 thumb jpg

http www sunbelt software com ihs alex screen00000000002 thumb jpg

The exploit uses a bug in VML in Internet Explorer to overflow a buffer and inject shellcode. It is currently on and off again at a number of sites.

Security researchers at Microsoft have been informed.

This story is developing and research is ongoing. Security professionals can contact me for collaboration or further information.

This exploit can be mitigated by turning off Javascripting.

Topics