Vulnerability Note VU#732479
Internet Explorer CMarkup use-after-free vulnerability
Overview
Microsoft Internet Explorer contains a use-after-free vulnerability in the MSHTML CMarkup component, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Microsoft Internet Explorer contains a use-after-free vulnerability in the CMarkup component of the MSHTML library. This can allow for arbitrary code execution. We have confirmed Internet Explorer 10 to be vulnerable. Other versions of Internet Explorer may also be affected. Note that this vulnerability is being exploited in the wild. The exploit in the wild currently only targets Internet Explorer 10 on systems that have Adobe Flash installed and do not have EMET installed. Windows 8 comes with Flash, so no additional software is required to be vulnerable to this particular exploit on that platform. Flash is used to bypass ASLR, at which point DEP can also be defeated. The Microsoft.XMLDOM ActiveX control is used to determine of EMET is installed on the target system. This is done by checking for the presence of C:\Windows\AppPatch\EMET.dll. If this file is present, the exploit attempt is aborted. |
Impact
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code. |
Solution
We are currently unaware of a practical solution to this problem. Please consider the following workarounds: |
Use the Microsoft Enhanced Mitigation Experience Toolkit The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will. Update to Internet Explorer 11 The public exploit for this vulnerability does not work with Internet Explorer 11. |
Vendor Information (Learn More)
| Vendor | Status | Date Notified | Date Updated |
|---|---|---|---|
| Microsoft Corporation | Affected | - | 14 Feb 2014 |
CVSS Metrics (Learn More)
| Group | Score | Vector |
|---|---|---|
| Base | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Temporal | 9.5 | E:H/RL:W/RC:C |
| Environmental | 9.5 | CDP:ND/TD:H/CR:ND/IR:ND/AR:ND |
References
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html
- http://community.websense.com/blogs/securitylabs/archive/2014/02/14/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx
- https://sites.google.com/site/zerodayresearch/smashing_the_heap_with_vector_Li.pdf
Credit
This vulnerability was publicly reported by FireEye.
This document was written by Will Dormann.
Other Information
- CVE IDs: CVE-2014-0322
- Date Public: 13 Feb 2014
- Date First Published: 14 Feb 2014
- Date Last Updated: 14 Feb 2014
- Document Revision: 17
No comments:
Post a Comment