Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
A critical Windows vulnerability that Microsoft patched in April continues be used in targeted attacks against companies, security researchers are warning.
Many of the attacks appear to be going after political, industrial and defense interests.
For instance, a malicious document exploiting the vulnerability, which resides in Windows Common Controls, recently targeted a defense contractor according to Sophos senior threat researcher Paul Baccas.
He did not identify the contractor, but wrote that there have been a "large number of files" exploiting the same vulnerability being emailed to companies in "a diverse number of sectors."
As reported by SC, another document specially crafted to exploit the same flaw targeted people interested in the recent ASEAN Defense Ministers' Meeting.
Symnatec software engineer Takashi Katsuki said when the malicious file was opened, it displayed a document containing contact information of each member country's military-related personnel.
The problem bug, CVE-2012-0158, remains in heavy use, Kaspersky Lab researcher Kurt Baumgartner told SC.
More than 90 exploit documents targeting the weakness have been collected as of June, according to a post by malware researcher Mila Parkour on the Contagio blog, a malware sample collection site.
The file names included references to a Pakistan and Chinese missile tests, military reports and even a fax to UNESCO. Other filenames were more generic, such as "schedule," "criteria" and "info." Most of the samples, collected between April and June, were "mostly APT targeted," Parkour wrote.
The exploit takes advantage of an issue in the component MCSOMCTL OCX, and if triggered could result in remote code execution.
This particular flaw affects Office 2003 through 2010 on Windows, SQL Server 2000 through 2008 R2, BizTalk Server 2002, Commerce Server 2002 through 2009 R2, Visual FoxPro 8 and 9, and Visual Basic 6 Run-time
"There are really no excuses for not having applied [the patch]," Baccas wrote.
This article originally appeared at scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.