Internet Explorer RCE exploited in the wild (CVE-2010-0249)
CVE-2010-0249
CVE-2010-0249: Critical IE 6-8 use-after-free RCE exploited in Operation Aurora. CVSS 9.3. All supported Windows versions affected. Disable or upgrade.
Actively exploited in the wild - CVE-2010-0249 is a critical use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 that grants remote attackers arbitrary code execution on the victim’s system. This zero-day was weaponized in December 2009 and January 2010 during the Operation Aurora attacks.
Overview
CVE-2010-0249, known as the “HTML Object Memory Corruption Vulnerability,” is a use-after-free flaw in the way Internet Explorer handles objects in memory. When the browser accesses a pointer associated with a deleted or incorrectly initialized object, an attacker can corrupt memory in a way that allows arbitrary code execution. The attack requires user interaction - typically luring a victim to a malicious webpage - but requires no special privileges or authentication.
This vulnerability affects Internet Explorer versions 6, 6 SP1, 7, and 8 on every supported Windows platform at the time, including Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7.
Impact
Successful exploitation gives an attacker the same user rights as the logged-on user. If the user has administrative privileges, the attacker gains full control of the system, including the ability to install programs, view/change/delete data, and create new accounts. The CVSS 9.3 rating reflects the network-based attack vector, low complexity, and critical confidentiality/integrity/availability impact.
During Operation Aurora, advanced persistent threat (APT) groups used this vulnerability alongside other zero-days to infiltrate major technology companies, including Google, Adobe, and others, stealing intellectual property and source code.
Remediation
Microsoft released an out-of-band security bulletin (MS10-002) on January 21, 2010, that patches this vulnerability. Organizations should:
- Apply MS10-002 immediately on all systems running Internet Explorer 6 through 8.
- Prioritize systems with administrative users and those exposed to external web traffic.
- If patching is delayed, disable Active Scripting in the Internet Zone, or use the Enhanced Security Configuration for IE on Windows Server editions.
- Consider upgrading to Internet Explorer 9 or later, which is not affected by this specific vulnerability.
Related Threats
- Weekly Threat Roundup: APT28 DNS Hijacking (Apr 6-12
- APT28 Hijacks SOHO Routers - Microsoft 365 Credentials
- Storm-1175 Exploits Zero-Days to Deploy Medusa
Security Insight
CVE-2010-0249 exemplifies the era when browser zero-days became the primary vector for state-sponsored espionage. Operation Aurora demonstrated that even memory corruption bugs in a single browser could enable large-scale data theft from the world’s most security-conscious companies. Fifteen years later, the same pattern persists: targeted zero-days in browsers remain the preferred tool for initial access in supply chain and intellectual property attacks.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Metasploit Modules
Weaponized exploit code — authorized use only
The Metasploit Framework modules below are production-ready exploit code maintained by Rapid7. Unlike random GitHub PoCs, these are vetted by Metasploit maintainers and integrated into a point-and-click exploitation framework used by red teams worldwide. The presence of an MSF module means this CVE is trivially exploitable at scale — patch immediately.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| Module | Source |
|---|---|
exploit/windows/browser/ms10_002_aurora | View source |
1 Metasploit module indexed for this CVE. Source: rapid7/metasploit-framework.
Exploit-DB Entries
Curated public exploit code — authorized use only
The entries below are human-reviewed exploit code hosted on Exploit-DB by Offensive Security. Lower volume than random GitHub PoCs but higher signal: every entry is curated, many are tagged "verified" by the maintainers. Treat as production-ready exploit code.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| EDB-ID | Title | Status |
|---|---|---|
| EDB-11167 | Microsoft Internet Explorer 6 - 'Aurora' Memory Corruption (MS10-002) | verified |
| EDB-16599 | Microsoft Internet Explorer - 'Aurora' Memory Corruption (MS10-002) (Metasploit) | verified |
2 Exploit-DB entries indexed for this CVE. Source: Exploit-DB.
Related Advisories
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving acce...
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a craft...
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP...
Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)...