RECON MTL 2017 evolution of pirpi
recon.cx · Undated · Licence: not cleared; local research copy only
CVEs this report names
6 CVEs- CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution5 reports94.9%Top 0.14%89.1priority
- CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox EvasionT1622Debugger Evasion+1 more · 3 reports99.8%Top 0.04%77.6priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports98.6%Top 0.08%74.8priority
- CVE-2014-4113Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft · Win32kKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1068Exploitation for Privilege Escalation1 report86.6%Top 0.26%72.3priority
- CVE-2014-1776Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting InterpreterT1499.004Application or System Exploitation2 reports82.7%Top 0.33%60.9priority
- CVE-2010-3962Microsoft Internet Explorer Uninitialized Memory Corruption VulnerabilityMicrosoft · Internet ExplorerKEVPublic exploitEnd of lifeHigh · 8.1T1059Command and Scripting Interpreter1 report96.8%Top 0.11%57.5priority
Where it names them
CVE-2014-6332 Original (opens in a new tab) ↗
(CVE-2014-6332)
CVE-2015-3113 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
(CVE-2015-3113)
for hash 4d3874480110ba537b3839cb8b416b50 and EXEProxy) Palo Alto Networks: https://researchcenter.paloaltonetworks.com/2015/07/apt -group-ups-targets-us-government-with-hacking-team- flash-exploit/ https://researchcenter.paloaltonetworks.com/2015/07/ups -observations-on-cve-2015-3113-prior-zero-days-and-
CVE-2015-5119 Original (opens in a new tab) ↗
(CVE-2015-5119)
CVE-2014-4113 Original (opens in a new tab) ↗
(CVE-2014-4113)
CVE-2014-1776 Original (opens in a new tab) ↗
(CVE-2014-1776)
CVE-2010-3962 Original (opens in a new tab) ↗
(CVE-2010-3962)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.