HTTP: Javascript fromCharCode Obfuscation Technique (8)

This signature detects scripts obfuscated (made unclear) with JavaScript. This is a technique commonly used by malicious Web sites to hide the malicious nature of the Web pages being downloaded by a user. A successful attack allows the Web page creator to take control of the victim's system.

Extended Description

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CPasteCommand Use After Free Vulnerability."

Affected Products

Microsoft internet_explorer

References

BugTraq: 67092 63631

CVE: CVE-2014-0515

URL: http://helpx.adobe.com/security/products/flash-player/apsb14-13.html http://www.securelist.com/en/blog/8212/New_Flash_Player_0_day_CVE_2014_0515_used_in_watering_hole_attacks http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2014-0515-the-recent-flash-zero-day/ http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx https://helpx.adobe.com/security/products/flash-player/apsb15-06.html https://www.fireeye.com/blog/threat-research/2015/04/angler_ek_exploiting.html http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134-and.html https://git.hacklab.kr/snippets/13 http://pastebin.com/Wj3NViUu

Short Name

HTTP:STC:SCRIPT:FROMCC-OBFUS-8

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Javascript fromCharCode Obfuscation Technique (8)

Extended Description

Affected Products

References

Found a potential security threat?