Windows patched bug continues to wreak havoc

By Fahmida Y. Rashid on Aug 8, 2012 8:03 AM
Filed under Security

Still in heavy use.

A "critical" Windows vulnerability that Microsoft patched in April continues be used in targeted attacks against companies, security researchers are warning.

Many of the attacks appear to be going after political, industrial and defense interests.

For instance, a malicious document exploiting the vulnerability, which resides in Windows Common Controls, recently targeted a defense contractor, Paul Baccas, senior threat researcher at Sophos, said last week in a blog post.

He did not identify the contractor, but wrote that there have been a "large number of files" exploiting the same vulnerability being emailed to companies in "a diverse number of sectors."

Another document specially crafted to exploit the same flaw targeted people interested in the recent ASEAN Defense Ministers' Meeting, said Takashi Katsuki, a software engineer with Symantec Security Response.

When the malicious file was opened, it displayed a document containing contact information of each member country's military-related personnel. It's not clear whether all the data in the file was legitimate. The malicious rich-text formatted (RTF) file was designed "to drop a clean MS Word document and open a back door," Katsuki wrote.

The problem bug, CVE-2012-0158, remains in heavy use,  Kaspersky Labresearcher Kurt Baumgartner said.

More than 90 exploit documents targeting the weakness have been collected as of June, according to a post by malware researcher Mila Parkour on the Contagio blog, a malware sample collection site.

The file names included references to a Pakistan and Chinese missile tests, military reports and even a fax to UNESCO. Other filenames were more generic, such as "schedule," "criteria" and "info." Most of the samples, collected between April and June, were "mostly APT targeted," Parkour wrote.

The exploit takes advantage of an issue in the component MCSOMCTL OCX, and if triggered could result in remote code execution. This particular flaw affects Office 2003 through 2010 on Windows, SQL Server 2000 through 2008 R2, BizTalk Server 2002, Commerce Server 2002 through 2009 R2, Visual FoxPro 8 and 9, and Visual Basic 6 Run-time

"There are really no excuses for not having applied [the patch]," Baccas wrote.

This article originally appeared at

Follow us on Facebook and Twitter

Copyright © SC Magazine, US edition

Windows patched bug continues to wreak havoc
Top Stories
Office 365 trainer signs first-ever Australian reseller
HubOne to bring ClipTraining's Microsoft education to our shores.
Former VMware staffer becomes Tintri's Australian chief
Also has Brocade, Legato country manager stints on resume.
HP's looming price hike could drive sales blitz
Australian rises of 10% or more coming, echoing Cisco and Apple.
Sign up to receive CRN email bulletins
Do you get value out of partner conferences?

Latest Comments
CRN Magazine

Issue: 335 | January/February 2015

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.