Exploit:JS/Mult.BM

Exploit:JS/Mult.BM is a generic detection for malicious HTML files that reference exploit code in malicious and specially crafted QuickTime media files (detected as Exploit:Win32/CVE-2009-1537). The malicious QuickTime media files exploit a vulnerability that could allow remote code execution.

This exploit has been observed to be hosted on Web pages modified by a remote attacker using an automated method. Users browsing the now malicious page could execute the exploit script.

 

As a result of successful exploit, other malware can be downloaded from various URLs to the infected machines to perform further malicious behaviors.  For example, in the wild it has been observed that encrypted copies of TrojanDownloader:Win32/Small.gen!AP (a trojan downloader), TrojanSpy:Win32/Lydra.AE (a data theft trojan) and variants of PWS:Win32/Wowsteal (online game password stealers) are downloaded to the infected machine.

Microsoft is aware of limited, active attacks that use this exploit code. While this matter is currently under investigation, it appears that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are currently vulnerable, and all versions of Windows Vista and Windows Server 2008 are not vulnerable.

 

If successful exploitation occurs, this exploit may download other malware in the system.

 

Microsoft Security Advisory 971778 discusses in greater detail the vulnerability that is currently exploited.