Cybercriminals target unpatched Microsoft XML Core Services exploit

An unpatched Microsoft XML Core Services (MSXML) vulnerability is being exploited in attacks launched from compromised websites to infect computers with malware, according to security researchers from antivirus vendor Sophos.

One such attack was spotted yesterday on the website of a European aeronautical parts supplier that had been hacked, Sophos senior technology consultant Graham Cluley said. It follows a similar attack detected over the weekend on the compromised website of an European medical company, he said.

Both compromised websites had rogue code injected into them that loaded an exploit for the CVE-2012-1889 MSXML vulnerability when accessed in Internet Explorer.

"A hacker who manages to plant malicious code on the website of, say, a company which supplies aeronautical parts may reasonably predict that staff at a larger organisation - such as an arms manufacturer or defence ministry - might have reason to access the site," Cluley said.

The MSXML vulnerability is believed to have been exploited in state-sponsored attacks against Gmail users earlier this month. Microsoft issued a security advisory about the flaw on June 12 and advised customers to apply one of several proposed work-arounds until a final security patch is released.

Exploit code that works on all versions of Internet Explorer on Windows XP, Vista and 7 has been added to the Metasploit penetration testing framework. "We expect this vulnerability to grow even more dangerous since there's no patch, and it's rather easy to trigger," the Metasploit developers said.

Even though a patch is not yet available, Microsoft has released a "Fix it" solution that prevents the exploitation of this vulnerability in Internet Explorer. "We strongly suggest that you consider this workaround - for now," Sophos senior threat researcher Paul Baccas said.