Online attackers never stand still and neither does the Exploit Writing Team stationed at CORE Labs. This past March, we added 25 exploit modules to our Security Testing framework that cover a wide range of technologies and target the biggest online threats our customers face every day. Add this to the total number of exploits and updates released since the beginning of the year, and we have added 87. Many of last month’s released exploit modules were developed in quick response to Patch Tuesday. We issued a DoS for MS12-020 exploit that targets Windows RDP. According to our customer usage statistics, this is the ninth most-common port they see open during penetration testing. We also issued a client-side exploit for MS12-022. While the Microsoft platform is widespread and therefore an attractive target to online attackers, it is also (relatively) easy to update which negates some of the target’s allure. By comparison, other commonly deployed technologies can be more difficult to patch and likely will be vulnerable for longer periods of time. Examples of these technologies – for each of which we released one or more exploit modules -- included those for Oracle, IBM, Adobe and Sysax.  Exploit Types and Number Released during March 2012

  • Client Side (7)
  • Maintenance (6)
  • Denial of Service (3)
  • Remote/Network (3)
  • Update to Remote Exploits (3)
  • Mobile (1)
  • Local/Privilege Escalation (1)
  • Update to Local/Privilege Escalation (1)

Exploit Updates Released during March 2012  Remote Code Execution

  • Motorola Netopia netOctopus SDCS Buffer Overflow
  • Citrix Provisioning Services Streamprocess Opcodes Buffer Overflow (Update)
  • Kingview SCADA HMI HistorySvr Heap Overflow (Update)
  • AT TFTP Server Long Filename Buffer Overflow (Update)
  • CA Total Defense UNCWS Web Service exportReport Remote Code Execution
  • Sysax Multi Server SSH Username Buffer Overflow

 Privilege Escalation

  • Linux mem_write Local Privilege Escalation
  • PAM Motd Privilege Escalation (Update)

 Client Side

  • Java MixerSequencer Object GM_Song Structure Handling
  • Oracle Java Web Start  XXaltjvm Option Command Line Injection
  • Microsoft Expression Design wintab32 DLL Hijacking (MS12-022)
  • IBM Personal Communications Buffer Overflow
  • IBM Tivoli Provisioning Manager Express for Software ActiveX Buffer Overflow
  • Oracle Java AtomicReferenceArray Type Confusion
  • Adobe Flash Player MP4 cprt Buffer Overflow

Denial of Service

  • Linux IGMPv3 DoS
  • Computer Associates eTrust Secure Content Manager DoS
  • Microsoft Windows Remote Desktop Protocol DoS (MS12-020)

Mobile Device

  • Android Webkit Floating Point Datatype