Home › Community › Security Blog

Security Blog

 

Threat Lab Report: MS09-002 Security Hole, A Malware Author's New Favorite

Posted By Netgear Threat Lab at 11:07 AM, March 20, 2009

Each new security vulnerability that is discovered opens up a new flood gate for malware authors to spread their work. Recently, the Microsoft Internet Explorer CFunctionPointer Memory Corruption Vulnerability (MS09-002) has paved the way for many new malware. This is a vulnerability found in Microsoft Internet Explorer 7. The specific flaw exists in the handling of document objects. When an object is appended and deleted in a specific order, memory corruption occurs. A vulnerable user could be exploited through a specially crafted web page, which can arrive through a different distribution vector such as a malicious file. Once the user views the web page, the vulnerability may allow remote code execution.

ms0900201_a.jpg Figure 1. The script used during the attack

ms0900202_4a.jpg Figure 2. Pointer points to the shell code which causes the buffer overflow

Although a patch for this security hole has already been released, our monitoring still shows large amounts of new malware being creating in attempt to exploit this vulnerability. Web sites that originally hosted Trojan horses to exploit MS08-78, instead now host Trojan horses that attempt to exploit this particular vulnerability (MS09-002). We believe that in the coming weeks, this security hole will still be one of the main ways malware authors use to spread malicious code.

Posted by: Netgear Threat Lab at 11:07 AM
Categories: Malware , Netgear Threat Lab

No TrackBacks

TrackBack URL: http://prosecure.netgear.com/cgi-bin/mt/mt-tb.cgi/12

Comments