In the first quarter of 2013, we spotted quite a few zero-day vulnerabilities affecting Oracle Java, Adobe Flash, Adobe Reader, and Microsoft Internet Explorer being exploited in the wild. This blog discusses the details of these zero-days exploited to spread malware in the first quarter of 2013.
Java zero-day vulnerabilities
During the month of January 2013, we saw some interesting Oracle Java SE zero-day issues being actively exploited in the wild. On January 13, 2013, Oracle released a security alert for Oracle Java Runtime Environment Multiple Remote Code Execution Vulnerabilities (CVE-2013-0422) to address multiple vulnerabilities in Java SE. The first vulnerability occurs in the way the public “getMBeanInstantiator” method in the “JmxMBeanServer” class is used to obtain a reference to a private “MBeanInstantiator” object, and then retrieving arbitrary Class references using the “findClass” method. The second vulnerability occurs because of using the Reflection API with recursion in a way that bypasses a security check by the “java.lang.invoke.MethodHandles.Lookup.checkSecurityManager” method due to the inability of the “sun.reflect.Reflection.getCallerClass” method to skip frames related to the new reflection API.
Immediately, after patching CVE-2012-0422, Oracle alerted the public about Oracle Java Runtime Environment Remote Code Execution Vulnerability (CVE-2012-3174) being exploited in wild to execute arbitrary code. Specifically, the issue occurs when the “MethodHandle” abstract class is used to invoke a method in the “sun.misc.reflect.Trampoline” class. This can allow the Security Manager to be bypassed.
On February 1, 2013, Oracle released a massive patch update for Java SE addressing 50 vulnerabilities. The Critical Patch Update (CPU) was originally scheduled for February 19, however it was released well in advance because of the exploitation in the wild of one of the vulnerabilities affecting the Java Runtime Environment (JRE) in desktop browsers. The details about this vulnerability are currently unknown. On February 19, Oracle released an updated Critical Patch Update (CPU) with an additional five fixes, bringing the total of fixes in the February 2013 CPU to 55.
On March 4, 2013, Oracle released yet another security alert about Oracle Java SE Remote Code Execution Vulnerability (CVE-2013-1493). This issue is prone to a remote code execution vulnerability that leads to arbitrary memory read and writes in the JVM process. This allows attackers to corrupt the memory and disable the Security Manager component.
Figure 1. Untrusted Applet exploits a vulnerability to disable the Security Manager and access system resources
The exploit conditions for all these vulnerabilities are the same i.e. they are remotely exploitable, without authentication, to execute arbitrary code in the context of the currently logged-in user. To successfully exploit the vulnerabilities, an attacker must entice an unsuspecting user into visiting a specially crafted webpage that contains a malicious applet. Successful exploits can impact the availability, integrity, and confidentiality of a user's system. Please note that these vulnerabilities do not affect Java running on servers, standalone Java desktop applications, or embedded Java applications.
Adobe Flash and Adobe Reader zero-day vulnerabilities
On February 7, 2013, Adobe released a security bulletin, APSB13-04, that included fixes for Adobe Flash Player Buffer Overflow Vulnerability (CVE-2013-0633) and Adobe Flash Player Remote Memory Corruption Vulnerability (CVE-2013-0634) which also affected the Adobe Flash application. These vulnerabilities were exploited in targeted attacks through spear phishing email messages targeting numerous industries. CVE-2013-0633 is a remote buffer-overflow vulnerability and CVE-2013-0634 is a remote memory-corruption vulnerability. An attacker can exploit these issues and execute arbitrary code in the context of the application or cause denial-of-service conditions. The samples discovered in-the-wild were delivered by tricking users into opening a Microsoft Word document sent as an email attachment that contains malicious Flash (SWF) content. These issues can also be exploited by enticing a user to visit a specially crafted site. Symantec detects these threats as Bloodhound.Flash.19 and Bloodhound.Flash.20.
On February 20, Adobe released a security bulletin, APSB13-07, that contained fixes for two interesting zero-day vulnerabilities, Adobe Acrobat And Reader Remote Code Execution Vulnerability (CVE-2013-0640) and Adobe Acrobat And Reader Remote Code Execution Vulnerability (CVE-2013-0641), affecting Adobe Reader X. The exploit for these issues worked in the latest versions of Adobe Reader and Adobe Acrobat that were available at the time, including versions X and XI, which both have a sandbox protection feature.
Figure 2. CVE-2013-0640 and CVE-2013-0641 vulnerabilities combine to bypass sandbox
The exploit was highly sophisticated and contained multiple evasion techniques, including heavily obfuscated JavaScript, ROP-only shellcode, and a multi-staged payload. The exploit worked in two stages. The first stage exploited the first vulnerability to have a code execution inside the sandboxed process in order to drop a malicious DLL file as the payload. The second stage used this payload to exploit the second vulnerability in a broker process and bypass the sandbox protection to drop the malware. Symantec detects the malicious PDF file as Trojan.Pidief and the two dropped DLL files as Trojan.Swaylib.
On February 26, 2013, the Adobe Product Security Incident Response Team (PSIRT) announced the availability of new security updates for Adobe Flash Player. This was the third time in February that they patched their code. The latest security bulletin, APSB13-08, addressed three Flash vulnerabilities, two of which were exploited in wild. These issues were used in targeted attacks that trick a user into visiting a site that contains malicious Flash (SWF) content. The exploits used for Adobe Flash Player Unspecified Security Vulnerability (CVE-2013-0643) and Adobe Flash Player Remote Code Execution Vulnerability (CVE-2013-0648) were designed to target the Mozilla Firefox browser. Specifically, the issue related to CVE-2013-0648 exists in the “ExternalInterface ActionScript” feature and CVE-2013-0643 exists because of a permissions issue with the Flash Player Firefox sandbox.
Microsoft Internet Explorer vulnerability
On December 27, 2012, a new Internet Explorer zero-day vulnerability was discovered being exploited in wild. Although this is not a 2013 zero-day, the exploitation of this issue continued into the first quarter of 2013. On January 14, 2013, Microsoft released a security bulletin containing fixes for this issue. The vulnerability occurred because of a user-after-free error when handling the “CButton” object in the mshtml.dll file. Certain popular websites were compromised to host the exploit as a part of a watering hole style attack. When users visited the compromised website, their computers were infected with malware, allowing attackers to extract valuable and sensitive information. Symantec had earlier published a research document surrounding watering hole attacks (The Elderwood Project) detailing targets, growing trends, and attack platforms that have been seen since 2009.
On March 16, 2013, we saw Microsoft Internet Explorer Use-After-Free Remote Code Execution Vulnerability (CVE-2013-1288) being exploited in wild. The issue occurred when handling the “CParaElement” object that was already freed and reused later and thus triggering the vulnerability. The issue was already patched by Microsoft on March 12, 2013. Discovering new zero-days can be a costly and time consuming business for malware authors. So it is speculated that the attackers may have reverse-engineered the patches to understand this vulnerability and craft an exploit. Though most systems would have already been patched, there would still be many unpatched systems during the first few days that attackers can compromise.
Conclusion
In total, we observed 11 zero-day vulnerabilities exploited in the first three months of 2013 affecting Oracle Java, Adobe Flash, Adobe Reader, and Microsoft Internet Explorer, which is quite high. This shows an increase in the finding and exploiting of zero-days. Plus the issues were discovered in popular applications allowing for maximum damage. Most of these flaws can be exploited over the Internet by enticing users to visit a site hosting the exploit. We also observed the attackers have started digging deeper to find vulnerabilities in the sandbox protection features of applications in order to bypass the restrictions for complete exploitation. A number of these flaws are used in different exploit kits and sold on the underground market.
Symantec recommends users to follow these best security practices:
- Ensure all applications are up to date with the latest security patches. Even though a zero-day exploit cannot be patched, the latest updates will provide protection from previously disclosed vulnerabilities.
- Ensure antivirus and IPS definitions are up-to-date.
- Avoid visiting sites of questionable integrity.
- Avoid opening files provided by untrusted sources.
- Implement multiple redundant layers of security such as non-executable and randomly mapped memory segments that may hinder an attacker's ability to exploit vulnerabilities.