Internet Explorer Vulnerability(MS12-043) Exploited in the Wild (August 30, 2013)
Dell Sonicwall Threats Research team has found multiple instances of malicious websites exploiting this old Internet Explorer Vulnerability. This vulnerability is already patched and has been assigned CVE-2012-1889. Metasploit also has a module msxml_get_definition_code_exec and we can see some similarities in the exploit code as outlined below.
There is obfuscation, heap allocation and shellcode setup. 
Vulnerable “MSXML3” control is included followed by its function call “definition” that triggers the condition.
Debugging shows heap spray and download of the url containing malicious executable.
A separate variant uses IP address for executable download
We detect multiple variants of this attack by following IPS signatures
- 7967 Microsoft XML Core Services Uninitialized Object Access 1
- 8007 Microsoft XML Core Services Uninitialized Object Access 6
- 7610 HTTP Client Shellcode Exploit 68b
- 7370 HTTP Client Shellcode Exploit 68a
- 5416 HTTP Client Shellcode Exploit 15a
- 4604 HTTP Client Shellcode Exploit 1a
- 4605 HTTP Client Shellcode Exploit 2
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.
