BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

BlackHole toolkit targets Microsoft XML Core Services flaw

Posted August 1, 2012    Sarah Lieber

Blackhole is a popular exploit kit used to inject malware onto PCs that visit an exploited site, or are redirected to such a site from another, compromised website.  As hackers get bolder they use these types of toolkits to compromise computer networks.  This allows less sophisticated individuals and organizations to compromise computer networks since these kits are relatively easy to attain and leverage.

The Blackhole exploit toolkit has been updated to take advantage of a Microsoft XML Core Services flaw, CVE-2012-1889.  The vulnerability applies to numerous supported Microsoft operating systems as well as some versions of Microsoft Office.  For more detailed information on this vulnerability and the list of patches provided by Microsoft, check out a recent blog post by Marc Maiffret. Or you can listen to the July 2012 Vulnerability Experts Forum (VEF).

BeyondTrust’s vulnerability management solution, Retina, not only identifies the vulnerability but also correlates it to the Blackhole exploit toolkit putting ‘Security in Context’ to ensure that security professionals and operational teams are made aware that there are known exploits and tool kits that put this vulnerability into a higher risk category.

In the above examples we see under the ‘exploit’ tab that there is a known exploit in the Exploit DB.  In the case where personnel resources are limited, this information is critical in determining where to apply resources for remediation.

Retina further uncovers the context of the vulnerability by including whether or not there are known malware toolkits leveraging the exploit.

As we mentioned above, these toolkits make it relatively ‘easy’ for nefarious individuals and organizations to quickly set-up websites that exploit this and other vulnerabilities.  Locating which vulnerabilities are included in these toolkits is critical to understanding where to focus resources for remediation and serve as the ‘low hanging fruit’ that the operational teams can focus on first from a remediation efforts perspective.

In addition to the details located in Retina CS, Retina Insight’s threat analyzers can help organizations quickly locate these low hanging fruit to determine the impact of remediating these vulnerabilities.

Users can leverage the built-in Risk Profiles (as shown above) or…

Users can also leverage the Risk Profile builder and create their own custom Profiles.  In this case I’m creating a profile that looks for Blackhole. Check out our blog post on Threat Analyzers, to find out more.

As you can see Retina provides organizations with numerous ways to quickly pare down vulnerabilities that put their organization at risk.  Additionally Retina CS provides remediation teams with the ability to deploy patches within the same console for complete vulnerability lifecycle management. Try a free trial of Retina CS now.

The latest audits database contains the following audits associated with MS12-043:

[16728] Microsoft XML Core Services Remote Code Execution (2722479) – KB2721693
[16739] Microsoft XML Core Services Remote Code Execution (2722479) – KB2721693 x64
[16730] Microsoft XML Core Services Remote Code Execution (2722479) – KB2721691
[16744] Microsoft XML Core Services Remote Code Execution (2722479) – KB2721691 x64
[16729] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 6.1
[16745] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 6.1 x64
[16731] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 6.0
[16746] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 6.0 x64
[16732] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 5.2
[16747] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 5.2 x64
[16733] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 5.1
[16748] Microsoft XML Core Services Remote Code Execution (2722479) – KB2719985 5.1 x64

Tags:
, , , , , , , ,

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,