Zero-Day Vulnerability in Internet Explorer

[upnorth]

Content source

https://heimdalsecurity.com/blog/security-alert-0-day-vulnerability-in-internet-explorer/

A new malicious code is wreaking havoc in corporate IT networks by exploiting a 0-day vulnerability in Internet Explorer.

Even if this browser is not the default one used by endpoints within your organization, you still have reason to be concerned. The malicious code gets into your systems through email and has the potential to corrupt the internal memory and afterward execute arbitrary code.

According to our intel, this malicious code has been abused in targeted attacks delivered through spear phishing. The 0-day vulnerability in Internet Explorer can be activated by attackers either via a drive-by attack or through a malicious link sent to the target through email.

The vulnerability has been assigned CVE ID: CVE2020-0674 and has been the topic of an official warning from Microsoft. This is a vulnerability that can be abused to corrupt memory via jscript and thereby execute arbitrary code on vulnerable systems. According to Microsoft, the remote code execution vulnerability could allow attackers to handle objects in memory in Internet Explorer through the scripting engine. Once an attacker obtains access to an endpoint in this manner, they could then gain the same user rights as the current user of that endpoint, and execute arbitrary code remotely.

Is there an update to address this vulnerability? No, Microsoft is aware of this vulnerability and working on a fix.

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV200001

 

[Antus67]

Good article upnorth thanks for the heads up

 

[Sampei Nihira]

It is inconceivable !!!
Instead, there is a temporary mitigation:

Microsoft provides mitigation for actively exploited CVE-2020-0674 IE 0Day

Microsoft published a security advisory to warn of an Internet Explorer (IE) zero-day vulnerability that is currently being exploited in the wild.

securityaffairs.co

For 32-bit systems, enter the following command at an administrative command prompt:

takeown /f %windir%\system32\jscript.dll
cacls %windir%\system32\jscript.dll /E /P everyone:N[/QUOTE]

For 64-bit systems, enter the following command at an administrative command prompt:

takeown /f %windir%\syswow64\jscript.dll
cacls %windir%\syswow64\jscript.dll /E /P everyone:N
takeown /f %windir%\system32\jscript.dll
cacls %windir%\system32\jscript.dll /E /P everyone:N

0patch releases micropatch for Internet Explorer vulnerability -- including for Windows 7

At the end of last week, a serious vulnerability was discovered in Internet Explorer, affecting all versions of Windows. Not only is the bug (CVE-2020-0674) being actively exploited, but for Windows 7 users the vulnerability was exposed right after their operating system reached the end of its life.

betanews.com

 

[Outpost]

It is inconceivable !!!

What's inconceivable?

Very good modification to the post with the addition of the link to 0patch

 

[show-Zi]

I disabled IE because the official version of Edge was distributed. I also want to remove the flash player. I feel the changing of times.

 

[ForgottenSeer 823865]

I disabled IE because the official version of Edge was distributed. I also want to remove the flash player. I feel the changing of times.

IE is the first thing i disable after a clean install ^^

 

[Sampei Nihira]

The Microsoft way of information is inconceivable.
Moreover, the uninstallation of I.E. does not end the problems of a zero day.
Because if the vulnerability also lies in the accessory dlls that can come into play in other applications ..... you are equally vulnerable.
The best way not to be vulnerable is to not use apps that use the I.E. engine.
If of course we know what these apps are.
This problem is obviously greater in OS prior to Windows 10.
I put below a non-exhaustive list of what I wrote above:

Trident (software) - Wikipedia

en.wikipedia.org

 

[show-Zi]

The Microsoft way of information is inconceivable.
Moreover, the uninstallation of I.E. does not end the problems of a zero day.
Because if the vulnerability also lies in the accessory dlls that can come into play in other applications ..... you are equally vulnerable.
The best way not to be vulnerable is to not use apps that use the I.E. engine.
If of course we know what these apps are.
This problem is obviously greater in OS prior to Windows 10.
I put below a non-exhaustive list of what I wrote above:

Trident (software) - Wikipedia

en.wikipedia.org

The dedicated browser for the Japanese bulletin board I use uses the IE engine. This may be a rather worrisome vulnerability, as there are many users in Japan.

IE is the first thing i disable after a clean install ^^

Windows and IE are boss-employee relationships. If you fire your employees early, you're hurting your Windows boss's pride.

 

[ForgottenSeer 823865]

Yeah, MS Is quite (purposely?) obscure about documenting their features, and you can see this "mindset" in the OS features themselves, no much explanations of what they do or may break.

 

[Brye]

Oh another one. Poor Microsoft.

 

[Azure]

Yeah, MS Is quite (purposely?) obscure about documenting their features, and you can see this "mindset" in the OS features themselves, no much explanations of what they do or may break.

Is almost like they think no one will ever use their secret hidden OS features.

 

[Sampei Nihira]

Microsoft recommends that Windows 7 users replace I.E.11 with the new Edge Chromium:

The Future of Internet Explorer in Windows

Microsoft Edge is Microsoft’s choice going forward

news.softpedia.com

........Given Microsoft Edge is also available on Windows 7, Microsoft recommends users to install this version – once they do this, the Chromium Microsoft Edge becomes the new default browser on the operating system, replacing Internet Explorer.............

 

[blackice]

Yeah, MS Is quite (purposely?) obscure about documenting their features, and you can see this "mindset" in the OS features themselves, no much explanations of what they do or may break.

At this point maybe they aren’t sure themselves what these features do.

 

[ForgottenSeer 823865]

At this point maybe they aren’t sure themselves what these features do.

They know, they are just very bad at explaining and document them.