Windows WMIObjectBroker (Visual Studio 2005) 0-Day Exploit

Published: 2006-11-09
Last Updated: 2006-11-09 14:17:21 UTC
by Johannes Ullrich (Version: 3)
0 comment(s)
Rohit from Tippingpoint adviced us that he is seeing a large number of attacks from Russia using an un-patched vulnerability in the WMIObjectBroker ActiveX control (CVE-2006-4704). He is seeing it used as part of a drive-by download. Typically, the Trojan "Galopoper.A" is load.

There is no patch available at this point. Tippingpoint and the Bleedingthreats projects have signatures available to detect this attack. Rohit mentioned that there is a metasploit module for this vulnerability.

The WMIObjectBroker ActiveX compontent is part of Visual Studio 2005 and associated with the WmiScriptUtils.dll . So you are only vulnerable if you find WmiScriptUtil.dll on your system. Also, by default this ActiveX component is not activated by default. For more details about this vulnerability see

Update:  Snort rules: 8369 and 8370.

0 comment(s)


Diary Archives