The Latest Exploits Shipped to Core Impact

Summary of all of the exploits and updates shipped to Core Impact 2017 R2 since Sept 26th (the last Dot release):

  • 17 Updates overall
  • 9 Remote Exploits
  • 3 Client-Side Exploits
  • 4 Local Exploits
  • 1 Product update

Published modules:

Remote Exploits:

  • Trend Micro Mobile Security for Enterprise upload_img_file Arbitrary File Upload Vulnerability Exploit
  • Adobe ColdFusion Java JMX-RMI Remote Code Execution Exploit
  • Apache Tomcat readonly Initialisation Parameter JSP Remote Code Execution Exploit
  • Dup Scout Enterprise Username Buffer Overflow Exploit
  • EFS Chat Server POST Buffer Overflow Exploit
  • Lepide Auditor Suite created Web Console Database Injection Remote Code Execution Vulnerability Exploit
  • SyncBreeze POST Username Buffer Overflow Exploit
  • VX Search Enterprise POST Buffer Overflow Exploit
  • REDDOXX Appliance ExecuteDiag Remote Command Injection Exploit

Client-Side Exploits:

  • Microsoft Office Memory Corruption Exploit (CVE-2017-11826)
  • Microsoft Office Memory Corruption Exploit (CVE-2017-11882)
  • WECON LeviStudio HMI Editor Buffer Overflow Exploit

Local Exploits:

  • CyberGhost CG6Service Service SetPeLauncherState Vulnerability Local Privilege Escalation Exploit Update
  • Jungo DriverWizard WinDriver Kernel Out-of-Bounds Write Privilege Escalation Exploit
  • Jungo DriverWizard WinDriver Kernel Out-of-Bounds Write Privilege Escalation Exploit Update
  • NVIDIA DxgDdiEscape Handler Privilege Escalation Exploit Update

Product Updates:

  • Assorted importer updates

Important Exploits to Highlight:

The MS Office memory corruption exploits can allow for an attacker to download and execute malware with no user interaction or disruption to the user currently using machine. These vulnerabilities affect all versions of Microsoft Office and all Microsoft Windows operative system versions and architectures released in the last 17 years (including MS Office 365) .  When used in conjunction with other MS vulnerabilities, this can lead to full control of target systems. Our exploit for CVE-2017-11826 was released on Oct 26th and our exploit for CVE-2017-11882 was released on Nov 21st , each was released only a few days after the announcement of the respective vulnerabilities. Both of these vulnerabilities are still being actively exploited in the wild.