3 ms·
Analysis from the FireEye research team outlining how it's done: http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explo
by Torn 12y ago
Analysis from the FireEye research team outlining how it's done: http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-d...
- codeulike 12y agoTLDR: Its done with Flash. Quelle Surprise. Disabling the Flash plugin within IE will prevent the exploit from functioning.
- tlrobinson 12y agoTo be fair, it sounds like it uses a combination of an IE bug and Flash bug. The exploit leverages a previously unknown use-after-free vulnerability, and uses a well-known Flash exploitation technique to achieve arbitrary memory access and bypass Windows’ ASLR and DEP protections. ... The SWF file calls back to Javascript in IE to trigger the IE bug and overwrite the length field of a Flash vector object in the heapspray.
- klt0825 12y agoFor now. Reading into it, it seems like they found one of the useful UAFs that facilitates a memory write instead of your less useful CALL virt_func. Flash is just a means to create an infoleak by over-wrting the vector length, it is likely that you could do the same without any dependencies by just targeting IE itself.