{"id":27404,"date":"2013-07-12T11:51:58","date_gmt":"2013-07-12T18:51:58","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=27404"},"modified":"2025-06-03T01:26:19","modified_gmt":"2025-06-03T08:26:19","slug":"new-zero-day-attack-copies-earlier-flash-exploitation","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-zero-day-attack-copies-earlier-flash-exploitation\/","title":{"rendered":"New Zero-Day Attack Copies Earlier Flash Exploitation"},"content":{"rendered":"

Late on July 10, Microsoft released a blog post<\/a> disclosing that they were aware of a zero-day attack in the wild. This attack exploits a previously unpatched Internet Explorer vulnerability (CVE-2013-3163). It\u2019s interesting that the vulnerability was just patched in this month\u2019s Patch Tuesday (July 9), which is perhaps only a coincidence. Although we do not know how long ago the attack began, we do have the official solution<\/a> right now. (Apply the Microsoft patch if you haven\u2019t done so.)<\/p>\n

McAfee Labs rapidly responded to the threat. While digging into the exploitation process, we realized that this attack leverages the same exploitation technology that we were first to identify in an Adobe Flash zero-day attack in February. We call the new exploitation technology the Flash Vector exploitation. As highlighted in our blog post from February, we made a fairly accurate prediction:<\/p>\n

More important, the technique looks like a common exploitation approach to Flash Player. The vulnerability actually doesn\u2019t help much\u2013just overwriting few bytes that are considered as a field of \u201celement number\u201d for a specific ActionScript object. These traits show that the exploitation technique is not limited to this particular Flash vulnerability; it may apply to other Flash or non-Flash vulnerabilities.<\/em><\/p>\n

Differences Between the Two Attacks<\/h2>\n

Both of these attacks leverage a weakness inside Flash Player’s custom heap management, especially, for the heap management of ActionScript “Vector.<>” objects. During our analysis, we also found some minor differences between these two attacks:<\/p>\n