IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch

Remote code execution vulnerability in Internet Explorer versions 7 through 11 being used to drop PlugX RAT.

A critical memory corruption vulnerability in Internet Explorer versions 7 through 11 that Microsoft released
an emergency patch
for yesterday is being used in watering hole and spearphishing attacks. Successful exploitation enables remote code execution and grants the attacker the same privileges as the current user.
The vulnerability, CVE-2015-2502, is a memory corruption bug, exploited by a hacker either hosting a malicious website or running malicious content on a legitimate site.
The attack seen in the wild has been using a malicious IFrame and drops a variant of the PlugX remote access Trojan, which calls a command-and-control server based in Korea,
according to Heimdal Security
.
“The recently exposed flaw does allow remote code execution so it is in a class that is pretty serious, says Cris Thomas, strategist at Tenable Network Security. The key here though, and the reason why Microsoft issued an out-of-band patch, isnt because this bug is super bad, but because bad guys are using this bug right now to break into people’s systems. However, Microsoft hasnt released any information with regards to how extensive that usage is. It is possible that this issue is only being used in selective, highly targeted attacks or it could be in widespread use on a botnet or third party web advertising network.
Unfortunately, there are no work-arounds for this bug. Ensuring that you have Microsofts Enhanced Mitigation Experience Toolkit configured will make exploiting this bug more difficult, but not impossible.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch