Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

BlackHole toolkit targets Microsoft XML Core Services flaw

August 1, 2012

  • Blog
  • Archive
Blackhole is a popular exploit kit used to inject malware onto PCs that visit an exploited site, or are redirected to such a site from another, compromised website. As hackers get bolder they use these types of toolkits to compromise computer networks. This allows less sophisticated individuals and organizations to compromise computer networks since these kits are relatively easy to attain and leverage. The Blackhole exploit toolkit has been updated to take advantage of a Microsoft XML Core Services flaw, CVE-2012-1889. The vulnerability applies to numerous supported Microsoft operating systems as well as some versions of Microsoft Office. For more detailed information on this vulnerability and the list of patches provided by Microsoft, check out a recent blog post by Marc Maiffret. Or you can listen to the July 2012 Vulnerability Experts Forum (VEF). BeyondTrust’s vulnerability management solution, Retina, not only identifies the vulnerability but also correlates it to the Blackhole exploit toolkit putting ‘Security in Context’ to ensure that security professionals and operational teams are made aware that there are known exploits and tool kits that put this vulnerability into a higher risk category. In the above examples we see under the ‘exploit’ tab that there is a known exploit in the Exploit DB. In the case where personnel resources are limited, this information is critical in determining where to apply resources for remediation. Retina further uncovers the context of the vulnerability by including whether or not there are known malware toolkits leveraging the exploit. As we mentioned above, these toolkits make it relatively ‘easy’ for nefarious individuals and organizations to quickly set-up websites that exploit this and other vulnerabilities. Locating which vulnerabilities are included in these toolkits is critical to understanding where to focus resources for remediation and serve as the ‘low hanging fruit’ that the operational teams can focus on first from a remediation efforts perspective. In addition to the details located in Retina CS, Retina Insight’s threat analyzers can help organizations quickly locate these low hanging fruit to determine the impact of remediating these vulnerabilities. Users can leverage the built-in Risk Profiles (as shown above) or… Users can also leverage the Risk Profile builder and create their own custom Profiles. In this case I’m creating a profile that looks for Blackhole. Check out our blog post on Threat Analyzers, to find out more. As you can see Retina provides organizations with numerous ways to quickly pare down vulnerabilities that put their organization at risk. Additionally Retina CS provides remediation teams with the ability to deploy patches within the same console for complete vulnerability lifecycle management. Try a free trial of Retina CS now. The latest audits database contains the following audits associated with MS12-043: [16728] Microsoft XML Core Services Remote Code Execution (2722479) - KB2721693 [16739] Microsoft XML Core Services Remote Code Execution (2722479) - KB2721693 x64 [16730] Microsoft XML Core Services Remote Code Execution (2722479) - KB2721691 [16744] Microsoft XML Core Services Remote Code Execution (2722479) - KB2721691 x64 [16729] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 6.1 [16745] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 6.1 x64 [16731] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 6.0 [16746] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 6.0 x64 [16732] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 5.2 [16747] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 5.2 x64 [16733] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 5.1 [16748] Microsoft XML Core Services Remote Code Execution (2722479) - KB2719985 5.1 x64
Photograph of Sarah Lieber

Sarah Lieber, Marketing Manager, Demand Generation & Strategy at BeyondTrust

Sarah is a highly dedicated and creative marketing professional with over a decade of experience in proven B2B demand-gen and campaign success in the cybersecurity space. Sarah strategically built and grew from the ground-up BeyondTrust's highly effective and successful world-wide webinar program. Yearly, the BeyondTrust webinar program involves over 100 cybersecurity experts and generates tens of thousands of attendees across the globe. See what's new with BeyondTrust webinars here: https://www.beyondtrust.com/resources/webcasts

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts

Rising CISOs: Ransomware, Cyber Extortion, Cloud Compromise, oh my!

Whitepapers

A Zero Trust Approach to Windows & Mac Endpoint Security

Whitepapers

Mapping BeyondTrust Solutions to the Qatar National Information Assurance Policy v2.0

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.