It is a busy day in the world of Microsoft security.
Tucked within the security bulletins released today are a number of vulnerabilities that have come under attack. Two of them are zero-days affecting the Windows kernel – CVE-2014-4148 and CVE-2014-4113 – and are fixed in MS14-058.
“In the case of CVE-2014-4148, the attackers exploited a vulnerability in the Microsoft Windows TrueType Font (TTF) processing subsystem, using a Microsoft Office document to embed and deliver a malicious TTF to an internal organization,” according to researchers at FireEye, who found the bug. “Since the embedded TTF is processed in kernel-‐mode, successful exploitation granted the attackers kernel-‐mode access. Though the TTF is delivered in a Microsoft Office document, the vulnerability does not reside within Microsoft Office.”
CVE-2014-4148 impacts both 32-bit and 64‐bit Windows operating systems, though the attacks only targeted 32-bit systems. The malware contained within the exploit has specific functions adapted to the following operating system platforms: Windows 8.1/Windows Server 2012 R2; Windows 8/Windows Server 2012; Windows 7/Windows Server 2008 R2 (Service Pack 0 and 1); and Windows XP Service Pack.
“Since TTF exploits target the underlying operating system, the vulnerability can be exploited through multiple attack vectors, including web pages,” explained researchers with FireEye. “In the past, exploit it authors have converted a similar exploit (CVE-2011-3402) for us in browser-based attacks.”
In this case, the TTF exploit is packaged within a Microsoft Office file.
CVE-2014-4113 meanwhile can be used against Microsoft Windows 7, Vista, XP, Windows 2000, Windows Server 2003/R2 and Windows Server 2008/R2 to escalate privileges locally. The vulnerability cannot be used on its own to compromise a customer’s security; instead, an attacker would first need to gain access to a remote system running any of the aforementioned operating systems so they could execute code within the context of the Windows kernel, FireEye explained.
An investigation by FireEye has uncovered evidence that attackers have likely used variations of these exploits for a while. Windows 8 and Windows Server 2012 and later are not susceptible to the issue.
“We have no evidence of these exploits being used by the same actors. Instead, we have only observed each exploit being used separately, in unrelated cases,” according to FireEye.
The revelations come as details have emerged about hackers using CVE-2014-4114 [MS14-60] to spy on NATO, the European Union, Ukraine and private energy and telecommunications companies. According to iSight Partners, the group began five years ago. The campaign was discovered to be targeting CVE-2014-4114 in August, and the group’s methods have evolved over time.
“We are attributing this particular cyber-espionage campaign to a…team that iSIGHT has dubbed ‘Sandworm Team’ based on its use of encoded references to the classic science fiction series Dune in command and control URLs and various malware samples,” according to the company. “The team has been previously referred to as [Quedagh] by F-Secure, which detailed elements of this campaign in 2014 but only captured a small component of the activities and failed to detail the use of the zero-day vulnerability.”
According to iSight Partners, the vulnerability exists because Windows allows the OLE packager (packager .dll) to download and execute INF files. In the case of the observed exploit, specifically when handling Microsoft PowerPoint files, the packagers allows a Package OLE object to reference arbitrary external files, such as INF files, from untrusted sources, iSight explained in an advisory.
*This story was updated to clarify when the Sandworm Team was formed.