cfo-as logo
Story image

Zero-day Internet Explorer vulnerability exploited in the wild

25 Sep 2019

On September 23, Microsoft released an out-of-band patch for a zero-day vulnerability in Internet Explorer that has been exploited in the wild.

Exploiting the vulnerability gives an attacker the same privileges as the current user.

Tenable senior security response manager Satnam Narang shares his findings on the vulnerability.

Analysis

CVE-2019-1367 is a memory corruption vulnerability in Internet Explorer’s scripting engine in the way that objects in memory are handled.  

Exploitation of this vulnerability could result in the attacker gaining arbitrary code execution under the same privileges as the current user.

In the event that the current user has administrative privileges, an attacker could perform various actions on the system, from creating a new account with full privileges to installing programs or even modifying data.

To exploit the vulnerability, an attacker would have to host the exploit on a malicious website and socially engineer a user into opening that website in Internet Explorer.

In the case of a targeted attack, an attacker could include a link to the malicious website in an email or in a malicious email attachment (HTML file, PDF file, Microsoft Office document) that supports embedding the scripting engine content.

The vulnerability was discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG).

Earlier this year, Lecigne discovered and reported two zero-day vulnerabilities: a use-after-free vulnerability in Google Chrome (CVE-2019-5786) and an elevation of privilege vulnerability in Microsoft Windows (CVE-2019-0808) that were exploited together in the wild.

Additional details about the in-the-wild exploitation of this vulnerability have not yet been made public by Lecigne and Google’s TAG, though we anticipate such details will be disclosed in a blog post in the near future.

Solution

Microsoft released an out-of-band patch for this vulnerability due to the report that it has been exploited in the wild.

Please refer to the Security Updates section for additional information on the IE Cumulative Update or relevant Security Updates.

Additionally, Microsoft has provided workarounds for both 32-bit and 64-bit systems by restricting access to the JScript.dll file.

An administrator can do so by entering specific commands into the command prompt; the commands are available at the end of the Microsoft security advisory page.

However, these workarounds should only be used as a temporary measure until patching is feasible.

Commands to revert the workarounds are also available on the Microsoft security advisory page.

ESET cybersecurity specialist Jake Moore says, “The importance of patching has never been so important and not just for those ‘early adopters’.

“Luckily there is a minimal share of the public still using IE as a browser, but it’s worth noting this could still have damaging consequences.”

Trustwave SpiderLabs EMEA director Ed Williams says, “The release of this patch underlines the importance of regular patching on an environment.

“It also highlights the importance of regular asset identification and vulnerability scanning of environments, for example, knowing what to patch once a vulnerability has been identified.

“We know that attackers are flexible and dynamic and will be looking to further leverage this vulnerability to suit their needs, be it financial or otherwise.

“While Internet Explorer isn’t as popular as it once was, it is still a rich target for attackers, and with the release of this patch, further emphasises why it is a business risk when compared to other browsers.

Story image
Finance teams take steps to basic automation - Trintech report
“The large number of respondents who indicated that they’re developing automation for their compliance process suggests that organizations are starting to move up the automation maturity curve."More
Story image
Adobe releases extensive update for Creative Cloud apps
Premiere Pro, After Effects, Character Animation and Premiere Rush are all available for user update today, offering performance enhancements, new creative tools, workflow refinements, and more.More
Story image
ASC launches Microsoft Teams communication recording app
ASC’s Recording Insights app integrates into Teams and enables online videos and chats to be recorded and archived, while meeting market requirements and ensuring complete compatibility with Microsoft’s service.More
Story image
New East Asia and Pacific vice president named for Avaya
Sami Ammous has been named as the new vice president for Avaya's East Asia and Pacific business, including Australia and New Zealand.More
Story image
Thai call center achieves business continuity with cloud solution
Tikal Call Center, the provider of the cloud-based service, has allowed for Teleinfo Media PLC to continue uninterrupted and high-quality service as a majority of technicians answer calls from their homes. More
Story image
Dell and Google Cloud deepen integration to bolster hybrid cloud storage
Dell and Google Cloud have announced the launch of their new hybrid cloud storage system, with the capability of moving as much as 50 petabytes of high-performance workloads.More