Internet Explorer 10 Use-After-Free Vulnerability Being Actively Exploited In The Wild

US-CERT: Internet Explorer 10 Use-After-Free Vulnerability Being Actively Exploited In The Wild

Internet Explorer 10 Use-After-Free Vulnerability Being Actively Exploited In The Wild Original release date: February 14, 2014 https://www.us-cert.gov/ncas/current-activity/2014/02/14/Internet-Explorer-10-Use-After-Free-Vulnerability-Being-Actively An unpatched Internet Explorer 10 use-after-free vulnerability is being exploited in the wild. CERT/CC Vulnerability Note VU#732479 has been published with further details about the vulnerability.  US-CERT recommends users protect themselves against this exploit by using Microsoft’s EMET utility, upgrading to Internet Explorer 11, or using an unaffected alternative web browser until a patch is released.

PRESS/HISTORY:

“Use After Free” Flaws: A New Theme for IE Vulnerability … Apr 9, 2013 –
Similar to the flaws in last month’s update, both of these vulnerabilities are what developers call “use after free” vulnerabilities – a type of …
http://watchguardsecuritycenter.com/2013/04/09/use-after-free-flaws-a-new-theme-for-ie-vulnerability/

Also in Firefox…..
VUPEN Vulnerability Research Team (VRT) Blog  Advanced Exploitation of Mozilla Firefox Use-after-free Vulnerability (MFSA 2012-22)  Published on 2012-06-25 17:45:24 UTC by Jordan Gruskovnjak
Hi everyone, In this new blog, we will share our technical analysis of a use-after-free vulnerability affecting Mozilla Firefox, and how we managed to achieve a reliable code execution and bypass DEP/ASLR using the same unique and non-trivial-to-exploit flaw. This specific vulnerability (CVE-2012-0469) has been patched by Mozilla as part of the MFSA 2012-22 security advisory.
http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php

SYMANTEC:
Microsoft Internet Explorer Use-After-Free Remote Code Execution Vulnerability ……….
Recommendations: Run all software as a nonprivileged user with minimal access rights. To reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights………..
http://www.symantec.com/security_response/vulnerability.jsp?bid=51933

Risk: High
Date Discovered: February 14, 2012
Description: Microsoft Internet Explorer is prone to a remote code-execution vulnerability because of a use-after-free error in the ‘Mshtml.dll’ library. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.
IN FULL:
http://www.symantec.com/security_response/vulnerability.jsp?bid=51933

Advertisements
%d bloggers like this: