Tag Archives: APT

MS13-051 / CVE-2013-1331 What We Know About Microsoft Office Zero Day

13/06/2013Reverse EngineeringAPT, CVE-2013-1331, Microsoft, MS13-051, Office, Office 0daywow

MS13-051 Microsoft Office bulletin was release Tuesday 11th 2013 during the traditional Patch Tuesday. This bulletin fix one vulnerability, CVE-2013-1331, with a base CVSS score of 9.3 and targeting Microsoft Office 2003 and Office for Mac (2011). This vulnerability allow remote code execution and was reported by Andrew Lyons and Neel Mehta of Google Inc.

Microsoft has also release additional information’s and it appears that some “bad guys” were using this vulnerability as a zero-day in targeted attacks. The vulnerability is related on how Microsoft Office render malformed PNG files leading to a classic stack based buffer overflow.

Malicious Office documents were referencing a malicious PNG file loaded from Internet and hosted on a remote servers. Remote servers were using scripts in order to avoid multiple times exploitation from the same source. Microsoft believe that attacks were limited to Indonesia and Malaysia.

Microsoft provided some examples of URLs invoked by the malicious Office document, and some hashes of the malicious Office binary format documents.

hXXp://intent.nofrillspace.com/users/web11_focus/4307/space.gif
hXXp://intent.nofrillspace.com/users/web11_focus/3807/space.gif
hXXp://mister.nofrillspace.com/users/web8_dice/3791/space.gif
hXXp://mister.nofrillspace.com/users/web8_dice/4226/space.gif
hXXp://www.bridginglinks.com/somebody/4698/space.gif
hXXp://www.police28122011.0fees.net/pages/013/space.gif
hXXp://zhongguoren.hostoi.com/news/space.gif

Information Gathering on “intent.nofrillspace.com“

By doing some researches we can find a Google cached Excel document mentioning this domain name the 2011-12-29. Domain name is mentioned as a gateway for malicious activities. Actually the web site is down, but associated IP was 80.93.50.73, hosted in the Russian Federation.

“No Frill Space” is a hosting company offering free web spaces. The company web site was still up, regarding WayBack Machine, the May 28th 2013. No additional information’s are available.

Information Gathering on “mister.nofrillspace.com“

By doing some researches we can find a Google cached web page as it appeared on 27 May 2013. Since, like the previous domain, the web site is no more available. No additional information’s are available.

Information Gathering on “www.bridginglinks.com“

Like “No Frill Space“, “BRIDGING LINKS” is a hosting company offering free web spaces. The company web site was still up, regarding WayBack Machine, the May 21th 2013. “www.bridginglinks.com” was hosted on 85.17.143.51 located in Netherlands.

If we take a look on urlQuery, we can see a submission dating of April 4th 2013, mentioning an interesting URL “hXXp://www.bridginglinks.com/somebody/4698/vw.php“. As you can see the path is the same as the path mentioned by Microsoft. “vw.php” could be one of the file used to avoid multiple times exploitation.

Joe Sandbox is also referencing Report 1482, no more available, that refer a URL “hXXp://www.bridginglinks.com/somebody/4688/vw.php?i=b95146-8a76c6cb7d84148d95ab5a4921b3839c” and a name of a Word document “virus_suspected.doc“. Associated MD5 of the document is “714876fdce62371da08c139377f23d76“, was submitted March 3th 2013, with a file size of 113.0 KB.

With the MD5 we can found a VirusTotal sample. Creation date of this document was February 25th 2013. Title of the document is “VN h?c gì t? v? Philippines ki?n TQ” that seem to be Vietnamese and could be translated to “VN learn from China’s conditions for Philippines“.

Document title seem to be related to the events of beginning of this year between China and Philippines regarding territory conflicts.

Here under a screenshot of the sample

@mwtracker also submitted a sample on Cryptam June 13th 2013.

Update of June 16th 2013

After doing some further investigations we noticed another Word sample (f85eaad502e51eafeae0430e56899d9b) submitted to VirusTotal October 28th 2009 and that has a creation date of October 26th 2009. A re-submission of this sample clearly detect CVE-2013-1331 !

By analyzing this sample title of the document is “The corruption of Mahathir” from autor “585“. “The corruption of Mahathir” document is a reference to Mahathir Mohamad a Malaysian politician who was the fourth Prime Minister of Malaysia, and the document is an adaptation of a Bangkok Post article to remind people how the country has been damaged by Dr M, UMNO and his cronies.

Like the previous sample, this sample is referencing “www.bridginglinks.com” and has exactly the same patterns.

Update of June 17th 2013

Microsoft has reference some hashes of the malicious Office documents. Here under more detailled information’s on these documents. All these malicious documents are actually only detected by Avast and Symantec.

35a6bbc6dda6a1b3a1679f166be11154 Office document

Document theme is related to telecommunications and has “Telco – XX??2013??????????” as title, that could be translated to “Telco – XX company in 2013 described the core network building program“. The document was created Wednesday March 6th 2013 and last saved by “abc“. The document initiate connexions to “hXXp://zhongguoren.hostoi.com/news/space.gif“.

fde37e60cc4be73dada0fb1ad3d5f273 Office document

Document theme is related to Susilo Bambang Yudhoyono an Indonesian politician and retired Army general officer who has been President of Indonesia since 2004. Document title is “Macam-macam critis terhadap SBY dan gerakan kabinet di situs Gerakan Anti SBY II” that could be translated to “Various critis against SBY cabinet and movement at the site of the anti SBY II“. The document was created Monday October 31th 2011 and last saved by “xmuser“. The document initiate connexions to “hXXp://mister.nofrillspace.com/users/web8_dice/4226/space.gif“.

2f1ab543b38a7ad61d5dbd72eb0524c4 Office document

Document theme is related to Chinese zodiac previsions for 2011, and document title is “Forecast for 2011“. The document was created Monday February 7th 2011 and last saved by “xmuser“. The document initiate connexions to “hXXp://intent.nofrillspace.com/users/web11_focus/3807/space.gif“.

28e81ca00146165385c8916bf0a61046 Office document

Document theme is Malaysian Telco. The document was created by “PDRM” and last saved by “abc“, also creation date of the document is Sunday October 14th 2012. The document initiate connexions to “hXXp://www.police28122011.0fees.net/pages/013/space.gif“.

7eb17991ed13960d57ed75c01f6f7fd5 Office document

Document theme is Indoleaks, an Indonesian equivalent of Wikileak, and document title is “Indoleaks, ‘Wikileaksnya’ Indonesia“. The document was created by “3565“, last saved by “xmuser” and created Sunday January 23th 2011. The document initiate connexions to “hXXp://mister.nofrillspace.com/users/web8_dice/3791/space.gif“.

70511e6e75aa38a4d92cd134caba16ef Office document

Document theme is surveillance devices with document title “Top 11 Aerial Surveillance Devices“. The document was last saved by “xmuser” and created Tuesday January 3th 2012. The document initiate connexions to “hXXp://intent.nofrillspace.com/users/web11_focus/4307/space.gif”

Conclusions

Here under a recap table of all behaviors

MD5	Author	Last Saved By	Creation Date	Last Saved Date	Domain	Params
714876fdce62371da08c139377f23d76	SYSTEM	SYSTEM	2013-02-24	2013-02-24	www.bridginglinks.com	95146-555210c567278074917c1d11f25a6221
f85eaad502e51eafeae0430e56899d9b	585	-	2009-11-26	2009-11-26	www.bridginglinks.com	41977-9c477a3c3bf9724fbd985772f6c50ef0
35a6bbc6dda6a1b3a1679f166be11154	User	abc	2013-03-06	2013-03-06	zhongguoren.hostoi.com	2064-ccca749e1a0e6806503c83048bb643d3
fde37e60cc4be73dada0fb1ad3d5f273	-	xmuser	2011-10-31	2011-10-31	mister.nofrillspace.com	81425-3b068ea3d53786a94aaa715c7692a0a1
2f1ab543b38a7ad61d5dbd72eb0524c4	-	xmuser	2011-02-07	2011-02-07	intent.nofrillspace.com	67575-80f27a85a4383ea2f92e8ba46c728ba3
28e81ca00146165385c8916bf0a61046	PDRM	abc	2012-10-14	2012-10-14	www.police28122011.0fees.net	013-8354f8a7f3c21f58d7dbfa2a943c88b8
7eb17991ed13960d57ed75c01f6f7fd5	3565	xmuser	2011-01-23	2011-01-23	mister.nofrillspace.com	66995-83fcb7c8e552c81da5611e93a856a399
70511e6e75aa38a4d92cd134caba16ef	-	xmuser	2012-01-03	2012-01-03	intent.nofrillspace.com	84435-81782ff9e4e204717db82d2e43a76f2d

My personal opinion is that:

I can clearly confirm that the zero-day was exploited in the wild since minimum ~~February 2013~~ October 2009
the campaign was active since a while and has surely target other victims than previously thought.

I will keep you in touch with additional information’s.

DOL Watering Hole Campaign and Sexy Swedish Soccer Supporter

12/05/2013VariousAPT, CVE-2013-1347, Department of Labor, DOL, Internet Explorer, Internet Explorer 0day, Microsoftwow

As I explained in my previous blog post, nine websites were involved in the DOL watering hole campaign. The first involved website was University Research Co. Cambodia (www[.]urccambodia[.]org) from 2013-03-15 to 2013-04-29. This website came out of the context of other websites used in this watering hole campaign.

The Better Health Services (BHS) is a USAID-funded health systems strengthening project in Cambodia that began in January 2009 and runs through December 2013. The BHS project’s goals dovetail with the mission of the Ministry of Health as stated in the Cambodian Health Strategic Plan 2008-2015 (HSP2) “to provide stewardship for the entire health sector and to ensure a supportive environment for increased demand and equitable access to quality health services in order that all the peoples of Cambodia are able to achieve the highest level of health and well-being.”

By continuing my researches on the gathered information’s found on dol[.]ns01[.]us backend and focusing on all information’s related to University Research Co. Cambodia website, I found some interesting behaviours.

In all the gathered information’s I firstly found a connection referer to www[.]urccambodia[.]org, this referer was a shortened URL http://t[.]co/RnWc0Z13Sc. Doing a google research on this shortened URL we can find a tweet from @natividad_usaid, dating from 2013-03-18.

If you observe @natividad_usaid, you will see that the account activity has begun the March 18th and finished the April 10th. Mostly all of the tweet have provide link to www[.]urccambodia[.]org, during the time of this website infection. Some twitter users were directly contacted in order to incite them to click to the link and most of these users were related to USAID (US Agency for International Development).

But most interesting is the profile description of this account and especially the shortened URL goo[.]gl/kpb7r how lead to “this is my pic.scr” file hosted on Dropbox. By analyzing this file it appear that it is Poison Ivy (504a32e123194a298018129404a1374e).

A malwr analysis of this sample reveal that “microsoftUpdate[.]ns1[.]name” is the contacted C&C server and that “conime.exe” file is also created. This C&C server is the same as mentioned by Crowdstrike, AlienVault and other security researchers or vendors, but from “bookmark.png” payload involved in Internet Explorer 8 0day (CVE-2013-1347).

It seem that this twitter account was only created and used to incite USAID twitter users to be infected through a www[.]urccambodia[.]org visit.

By continuing to analyze www[.]urccambodia[.]org related gathered information’s, I found a second connection referer to www[.]urccambodia[.]org. This referer is the Facebook profile of Kelly Black “http://www.facebook.com/kelly.black.92754“.

This sexy lady, posing with a friend, pretend to have work for USAID, to have study at UVA College of Arts & Sciences Alumni, to live in Washington, District of Columbia and to be from Springfield, Illinois.

Kelly Black account activity has start and stopped the same day, the March 24th. Most of the posts of this “lady” are link to infected www[.]urccambodia[.]org website and/or to project around sanitation of Mekong waters organized by US organization’s.

This sexy lady has, in one day of activity, 41 friends and most of these friends are from USAID or from others organization’s.

Now the funny part of the story, on the picture you can see two beautiful women with a yellow T-shirt and they seem to enjoy the live. One of the friends of Kelly Black was interesting to know which of the two she was, and the “bad guys” toke the time to respond to him 🙂

But I was intrigued by this picture and decided to compare this one on Internet, and ho miracle these ladies are not US women from Springfield, Illinois, but Swedish supporters who were photographed during European soccer cup in Poland/Ukraine.

You can find this photo through TinEye or Google pictures comparison services. This photo is present on different medias, ActionPlus, DailyMail and bunch of other websites.

Department of Labor Watering Hole Campaign Review

10/05/2013Reverse EngineeringAPSA13-03, APT, CFR, CVE-2012-4792, CVE-2013-1347, CVE-2013-3336, Department of Labor, DOL, Internet Explorer, Internet Explorer 0day, Microsoft, MSA-2847140, watering hole attackswow

On April 30th, the watering hole campaign was published on a private mailing list and the May 1st, Invicia and AlienVault publicly reported, with technical details, that United States Department of Labor (DOL) Site Exposure Matrices (SEM) website had been compromised and was hosting malicious code. This malicious code was used in watering hole attack targeting at first employees of US Dept of Energy that work in nuclear weapons programs. This malicious code was also used to gather information’s on the visitors of the compromised website.

The exploit used in this campaign was firstly reported as CVE-2012-4792, an Internet Explorer 0day used in December 2012 in CFR.org watering hole campaign and patched by Microsoft in January 2013. Despite the patch release some forks of this exploit were still used in targeted attacks against political parties, political dissidents, online medias and human right activists.

Two days later, FireEye, Invicia and AlienVault concluded that the vulnerability targeted during this attack campaign was not CVE-2012-4792 as they originally reported but a new Internet Explorer 8 vulnerability identified as CVE-2013-1347. This turnaround had unfortunately occur to late. Casual attacker, chaotic actors, organized crime and potentially other states involved in sponsored espionage had the opportunity to study the attack and recover the evidences.

Microsoft has acknowledge the vulnerability in a Microsoft Security Advisory published on May 3rd and identified as MSA-2847140 and has provide a “Fix it” solution to mitigate Internet Explorer 8 vulnerability.

Also, Adobe has announce through APSA13-03 that a critical vulnerability (CVE-2013-3336) is actually exploited against ColdFusion. This vulnerability could permit an unauthorized user to remotely retrieve files stored on the server, through “CFIDE/administrator“, “CFIDE/adminapi” and “CFIDE/gettingstarted*” directories. Adobe ColdFusion is used by DOL and this vulnerability has surely be used in order to compromise the server.

Possible Causes of Confusion between CVE-2012-4792 and CVE-2013-1347

Confusions with CVE-2012-4792 was possible due to similarities in used code and technics:

Usage of widely used JavaScript functions and variables

“function getCookieVal(offset)“, widely used, is also present in original CVE-2012-4792 exploit and other forks.
“function GetCookie(name)“, widely used, is also present in original CVE-2012-4792 exploit and other forks.
“function SetCookie(name,value)“, widely used, is also present in original CVE-2012-4792 exploit and other forks.
“var ua = window.navigator.userAgent.toLowerCase()“, widely used, is also present in original CVE-2012-4792 exploit and other forks.

Usage of particular JavaScript functions also present in previous watering hole campaigns

“function DisplayInfo()” also seen in CVE-2012-4792 & CVE-2011-0611 exploits.
“function download()” & “function callback()” also seen in CVE-2012-4792 exploit.

Usage of Ajax XMLHttpRequest

This JavaScript object is used to download “bookmark.png” file and was also used to download “xsainfo.jpg” file in CVE-2012-4792.

Similarities in the JavaScript code structure

If you compare the original CVE-2012-4792 JavaScript code and Exodus Intel fork, with this new exploit, the code structure is very similar in many aspects.

Usage of HTML+TIME technic

HTML+TIME, which is based on the Synchronized Multimedia Integration Language (SMIL), was also used in certain CVE-2012-4792. This technic was explained by Exodus Intel beginning January 2013.

Target selection

Parts of the code targets only Windows XP, Internet Explorer 8 and certain languages, like CVE-2012-4792.

Differences between CVE-2012-4792 and CVE-2013-1347, and Particularities

Some new particularities were present in the exploit and associated watering hole campaign:

Usage of PHP files

All previous watering hole attacks have use HTML or JavaScript files. PHP usage naturally limit the number of potential servers who could be used to start the exploitation and spread the malware. This approach increasingly the technic used by Exploit Kits, maybe a source of inspiration and effectiveness for states involved in sponsored espionage.

Usage of Base64 obfuscation

Obfuscation with base64 encoding (“base64.js” file) was used to hide parts of the exploit. CVE-2012-4792 was using “robots.txt” obfuscated with substitutions and HEX encoding.

Use-After-Free type

As mentioned by sinn3r of Metasploit team, CVE-2012-4792 was a CButton object use-after-free and CVE-2013-1347 is a CGenericElement object use-after-free.

dol[.]ns01[.]us Exploit Hosting Domain Evolutions

Invicia and AlienVault have report that the browser was redirected to the content hosted at dol[.]ns01[.]us which lead to the infection. A urlQuery, of 2013-05-01, is mentioned and refer to dol[.]ns01[.]us on port 8081/TCP. One hit related to the information gathering script is mentioning a last modified date of Thu, 14 Mar 2013 20:06:36 GMT. You can also observe in the executed JavaScript that the hxxp://dol[.]ns01[.]us:8081/web/js.php and hxxp://dol[.]ns01[.]us:8081/web/css.js URL’s are present in the code.

But if you take a look to a previous urlQuery report of 2013-04-29, hxxp://96[.]44[.]136[.]115/web/js.php, hxxp://96[.]44[.]136[.]115/web/css.js and hxxp:///web/xss.php are mentioned and coded in the executed JavaScript. 96[.]44[.]136[.]115 IP address is mentioned by AlienVault as the IP address behind dol[.]ns01[.]us. As you can see no specific destination port is present and the last modified date is the same. So we can conclude that the guys behind this campaign have change the malicious code during this interval.

You can observe this evolution with the urlQuery submission of 2013-04-30.

All these urlQuery submission’s were done with a non Internet Explorer 8 user agent, and as the exploit malicious code was designed to only target Windows XP and Internet Explorer 8, part of the redirection were not present as evidences.

If you observe “/scripts/textsize.js” JavaScript code hosted on DOL website, you can see a first JavaScript inclusion to “hxxp://dol[.]ns01[.]us:8081/web/xss.php” and a second one to “hxxp://dol[.]ns01[.]us:8081/update/index.php“.

The first inclusion “/web/xss.php” was used in order to gather information’s on the DOL website visitors and the second inclusion “/update/index.php” was used to start the exploitation of CVE-2013-1347.

Information Gathering Scripts

As described by AlienVault, the information gathering code “/web/xss.php” on dol[.]ns01[.]us use different JavaScript functions to collect information’s from the system and upload the result to the malicious server.

I found that the information’s gathering script was different depending on the used browser. Here under a description of the JavaScript functions involved in information’s gathering depending on used browsers.

DOL Information Gathering Functions

JavaScript Function(s)	Targeted Browser(s)	Function Description
jstocreate()	Internet Explorer	Test the presence of the Avira, Bitdefender 2013, McAfee VirusScan Enterprise, AVG Secure Search, ESET NOD32, Dr.Web, Microsoft Security Essentials, Sophos, F-Secure Antivirus 2011, Kaspersky 2012, Kaspersky 2013 anti-viruses.
flashver()	Internet Explorer & Firefox & Chrome	Test the presence and version of Adobe Flash, and supported OS.
officever()	Internet Explorer	Test the presence and version of Microsoft Office
plugin_pdf_ie()	Internet Explorer	Test the presence of Adobe Reader
bitdefender2012check()	Internet Explorer & Firefox & Chrome	Test the presence of BitDefender 2012 and try to disable it through disabledbitdefender_2012() function.
java()	Internet Explorer & Firefox & Chrome	Test the presence and version of Oracle Java plug-in
xunleicheck()	Firefox & Chrome	Test the presence of xThunder Chrome extension, an extension managing popular downloaders.
kavcheck()	Firefox & Chrome	Test the presence of Kaspersky Chrome extension
fiddlercheck()	Firefox & Chrome	Test the presence of Fiddler Chrome extension. Fiddler is an HTTP debugging proxy server application
liveheadercheck()	Firefox & Chrome	Test the presence of Live HTTP Header Chrome extension
webdevelopercheck()	Firefox & Chrome	Test the presence of Web Developer Chrome extension
avg2012check()	Firefox & Chrome	Test the presence of AVG 2012 Chrome extension
tamperdatacheck()	Firefox & Chrome	Test the presence of Tamper data Chrome extension
adblockcheck()	Firefox & Chrome	Test the presence of Adblocker Chrome extension
avastcheck()	Firefox & Chrome	Test the presence of Avast! Chrome extention
pluginverother()	Firefox & Chrome	Test the presence of all installed modules

All functions used by the information gathering script involved in the DOL watering hole campaign.

Also a specific information gathering technic was triggered when Internet Explorer was used. This technic is related to a non patched vulnerability in Internet Explorer 8, discovered by NSFOCUS and reported to Microsoft in 2011. The vulnerability could allow user information and even local file content leakage if a user views a specially crafted webpage using Internet Explorer.

Once all information’s gathered, the script send all data’s on a specific URL “hxxp://dol[.]ns01[.]us:8081/web/js.php” and also call “hxxp://dol[.]ns01[.]us:8081/web/css.js” when the information’s are collected.

An interesting information regarding “/web/css.js“, is that the “Last Modified” date reported by “dol[.]ns01[.]us” server is Thu, 14 Mar 2013 20:06:36 GMT. This is reporting that the information gathering infrastructure was in place since mid-March minimum.

Interesting facts regarding these information gathering scripts are:

Scripts “xss.php“, “js.php” & “css.js” have move from IP 96[.]44[.]136[.]115 on port 80/TCP to domain dol[.]ns01[.]us port 8081/TCP. Move from port 80/TCP to 8081/TCP doesn’t seem to be logic, most of time outgoing connexion’s authorized on Firewalls, for corporate Web surfing, are 80/TCP and 443/TCP.
Different types of information gathering scripts were in place, and all users who have visit DOL website were affected by this information gathering campaign.
Usage of a specific information leakage vulnerability present in Internet Explorer 8 and not fixed by Microsoft.
BitDefender 2012 deactivation attempt is confusing. Why trying to deactivate an anti-virus, this will surely generate an alert.

Information Gathered on dol[.]ns01[.]us

As described in the previous chapter, the information gathering code send a lot of information’s to the backend. Hopefully for security researchers, the backend wasn’t very well protected and all collected information’s were accessible without any restrictions in different web folders. You can find here under some statistics related to the gathered information’s.

Complete geolocation of the targeted source IPs

By analyzing the information’s sent to the backend, we can also see that DOL (www.sem.dol.gov) wasn’t the only compromised website:

From 2013-03-15 to 2013-04-29 : University Research Co. Cambodia website (www.urccambodia.org) was the first target .This explain the high number of distinct IP addresses from Cambodia.
From 2013-04-08 to 2013-04-24 : Awards for Excellence in Education website (www.forexcellenceineducation.org), a program of Fraser Institute, was the second target.
From 2013-04-08 to 2013-04-24 : ElectionGuide website (www.electionguide.org), provided by the International Foundation for Electoral Systems (IFES), was the third target.
From 2013-04-09 to 2013-04-30 : French Institute of International Relations website (www.ifri.org), was the fourth target.
From 2013-04-09 to 2013-04-24 : The Working for America Institute website (www.workingforamerica.org), was the fifth target.
From 2013-04-09 to 2013-04-10 : The Project 2049 Institute website (www.project2049.net), was the sixth target.
From 2013-04-10 to 2013-04-10 : The Union Label and Service Trades Department website (www.unionlabel.org), was the seventh target.
From 2013-04-11 to 2013-04-30 : Thales Catalogue website (components-subsystems.thales-catalogue.com), was the eighth target.
From 2013-04-23 to 2013-05-01 : United States Department of Labor (DOL) Site Exposure Matrices (SEM) website (www.sem.dol.gov), was the ninth target.

Here under the hits by browsers and Internet Explorer 8 hits by OS.

Others Information’s Gathered

As you have read in the previous chapter, ElectionGuide website (www.electionguide.org) was also targeted during this watering hole campaign. As you can see in the following urlQuery submission, dating from 2013-05-01, 96[.]44[.]136[.]115 is also present but don’t respond any more. Also if you observe the urlQuery submission of 2013-05-03, 96[.]44[.]136[.]115 is still present, but a new backend server has been setup in order replace the once deactivated.

If you observe the “Last Modified” date of “css.js” file, the installation date of these files is at least the 2013-05-03.

Also, by researching some patterns matching the information’s gathering script on Google you can find some previous unknown campaigns, that were using the same code.

CVE-2013-1347 Microsoft Internet Explorer 8 Vulnerability Metasploit Demo

05/05/2013Exploits, MetasploitAPT, CVE-2013-1347, DOL, Internet Explorer, Internet Explorer 0day, Microsoft, MSA-2847140, Windowswow

Timeline :

Watering hole campaign first reported on a private mailing list the 2013-04-30
Watering hole campaign publicly disclosed by AlienVault and Invincea the 2013-04-30
0day exploit spotted by FireEye the 2013-05-03
Microsoft Security Advisory posted the 2013-05-03
Metasploit PoC provided the 2013-05-05

PoC provided by :

Unknown
EMH
juan vazquez
sinn3r

Reference(s) :

CVE-2013-1347
OSVDB-92993
MSA-2847140

Affected version(s) :

Internet Explorer 8

Tested on Windows XP Pro SP3 with :