IE CVE-2012-4792: 2012 Watering-Hole Zero-Day in KEV

What to do

1. Search your inventory for Windows XP, Server 2003, Vista and Server 2008 hosts, and for Windows 7 or Server 2008 R2 machines still on IE 8.
2. Replace or upgrade those systems; if one must stay, confirm MS13-008 (KB2799329) or a later IE cumulative update is installed.
3. Do not rely on workarounds such as the 2012 Fix it shim, which Exodus Intelligence bypassed within a day.
4. Block legacy hosts from browsing the internet and reading email, and isolate them on their own segment.
5. Leave Edge and IE mode settings on supported Windows alone; they are not affected.

How to check if you are affected or compromised

• On a legacy host, run reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer" /v Version to read the IE version.
• Run systeminfo or wmic qfe list and look for KB2799329 or a later IE cumulative update.
• Review proxy logs for hosts that send MSIE 6.0, 7.0 or 8.0 user agents.

What happened#

Around Christmas 2012, attackers served an Internet Explorer zero-day from the website of the Council on Foreign Relations (CFR), a US think tank. The Register reported that FireEye found it on the site on December 27, and that the attack had run for at least a week. The Hacker News adds that the Capstone Turbine Corporation website was also used.

The CVE record gives December 29, 2012 as the public date and describes a use-after-free in IE 6 through 8. CERT/CC's VU#154201 says crafted JavaScript freed a CButton object while a pointer to it remained, and that the live exploit used Adobe Flash for a heap spray. Microsoft's first answer was Security Advisory 2794220 and a Fix it shim. Exodus bypassed the shim after "less than a day of reverse engineering" and reported it to Microsoft. The real fix, MS13-008 (KB2799329), shipped on January 14, 2013. It credits Exodus and confirms "targeted attacks" through IE 8. Exploit code is public as a Metasploit module.

On July 23, 2024, CISA added the CVE to KEV with a Twilio Authy bug, "based on evidence of active exploitation." It gave no new details, and The Hacker News wrote that it was "currently not clear" whether the bug had been exploited again. We found no later public report as of Oct 23, 2026. The 2012 attacks are documented exploitation in their own right. KEV's required action says the product "is end-of-life and should be disconnected if still in use."

Who is affected#

Per MS13-008, IE 6, 7 and 8 on Windows XP, Server 2003, Vista, Server 2008, Windows 7 and Server 2008 R2. IE 9 and IE 10 were not affected. Microsoft rated it Critical on clients and Moderate on servers, where IE's Enhanced Security Configuration mitigates it. NVD scores it CVSS 3.1 8.8.

Do you really need to act?#

Almost certainly not. Microsoft's lifecycle FAQ lists IE 9 or IE 11 for every desktop and server Windows release it still covers. Even IE 11 lost support on Windows 10 semi-annual channel on June 15, 2022, per the IE 11 lifecycle page that CISA cites. The attack also needs a user to visit a malicious or compromised page.

The exception is the forgotten box, such as an XP or Windows 7 machine running a kiosk, a lab instrument or a plant-floor HMI. This bug also shows that a workaround is not a fix: Exodus beat this one in a day. CISA has since added other old IE bugs to KEV: CVE-2013-3893, CVE-2010-3962 (it has its own brief), CVE-2010-0249 and CVE-2010-0806. Patching one CVE does not make IE 8 safe. Isolation and replacement do.

What to do now#

1. Search your inventory for XP, Server 2003, Vista and Server 2008 hosts, and for Windows 7 or Server 2008 R2 machines still on IE 8.
2. Replace or upgrade them. If one must stay, confirm that MS13-008 or a later IE cumulative update is installed.
3. Block legacy hosts from browsing and email, and put them on an isolated segment.

How to tell if you were hit#

On a legacy host, run reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer" /v Version to read the IE version. Then check wmic qfe list or systeminfo for KB2799329 or a later IE update. In proxy logs, look for MSIE 6.0, 7.0 or 8.0 user agents. A machine that browsed the web on unpatched IE 8 for years should be treated as untrusted, so rebuild it rather than hunt for this one exploit.

Timeline#

• Dec 27, 2012 — FireEye finds the exploit on the CFR website.
• Dec 29, 2012 — Public date in the CVE record. CERT/CC publishes VU#154201.
• Jan 4, 2013 — Exodus Intelligence describes its bypass of the Fix it shim.
• Jan 14, 2013 — Microsoft releases MS13-008.
• Jul 23, 2024 — CISA adds CVE-2012-4792 to KEV.
• Aug 13, 2024 — Federal remediation deadline.

Vulnerability records

• CVE-2012-4792 · KEV 2024-07-23 · Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Bulletin MS13-008: Security Update for Internet Explorer (2799329) learn.microsoft.com
2. CVE record — CVE-2012-4792 cve.org
3. NVD — CVE-2012-4792 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2012-4792 cisa.gov
5. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Jul 23, 2024) cisa.gov
6. CERT/CC — VU#154201: Microsoft Internet Explorer CButton use-after-free vulnerability kb.cert.org
7. Exodus Intelligence — Happy New Year Analysis of CVE-2012-4792 blog.exodusintel.com
8. Exodus Intelligence — Bypassing Microsoft's Internet Explorer 0day Fix It Patch for CVE-2012-4792 blog.exodusintel.com
9. Microsoft — Lifecycle: Internet Explorer 11 learn.microsoft.com
10. Microsoft — Lifecycle FAQ: Internet Explorer and Microsoft Edge learn.microsoft.com
11. Rapid7 — Metasploit module ie_cbutton_uaf (MS13-008) github.com

Coverage and analysis

1. The Register — Microsoft scrambles to thwart new Internet Explorer 0-day attack theregister.com
2. The Hacker News — CISA Adds Twilio Authy and IE Flaws to Exploited Vulnerabilities List thehackernews.com