Threat of the month: MS zero-day
Threat of the month: pdf.exe.zip files
What is it?
A zero-day vulnerability in Microsoft XML Core Services, which is included with various Microsoft products to provide W3C compliant APIs for parsing of XML content.
How does it work?
The vulnerability is caused by an error in the “DOMNode::get_definition” function when the “definition” method is called for a DOM object, causing the value of a VARIANTARG to be left uninitialized. Later, this value is dereferenced as an object pointer, which allows gaining control of the program flow since it is possible to cause the stack space storing the uninitialized VARIANTARG value to contain attacker-controlled data.
Should I be worried?
The vulnerability is being actively exploited via Internet Explorer.
How can I prevent it?
Microsoft released patches for this flaw in mid-July. Previous to the release, Microsoft issued a security advisory, KB2719615, with a Fix it solution that can be used as a workaround to block the attack vector.
