Vulnerability

CERT-In Vulnerability Note CIVN-2014-0247
Multiple Vulnerabilities in Microsoft Internet Explorer

Original Issue Date:November 12, 2014

Severity Rating: HIGH

Systems Affected

Windows Server 2003 SP2, x64 Edition SP2, SP2 for Itanium-based Systems
Windows Vista SP2 and x64 Edition SP2
Windows Server 2008 for 32-bit Systems SP2, x64-based Systems SP2 and Itanium-based Systems SP2
Windows 7 for 32-bit Systems SP1 and x64-based Systems SP1
Windows Server 2008 R2 for x64-based Systems SP1 and Itanium-based Systems SP1
Windows 8 for 32-bit Systems and x64-based Systems
Windows 8.1 for 32-bit Systems and x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1

Component Affected

Internet Explorer 6, 7, 8, 9, 10 and 11

Overview

Multiple vulnerabilities have been reported in Microsoft Internet Explorer which could allow a remote attacker to gain elevation of privileges, cause security bypass, allow execution of arbitrary code or disclose sensitive information on the targeted system.

Description

1. Privilege Elevation Vulnerabilities ( CVE-2014-6349   CVE-2014-6350   )

Two privilege elevation vulnerabilities exist in Internet Explorer due to improper validation of permissions under specific conditions. A remote attacker could exploit this vulnerability by convincing the user to view a specially crafted website. Successful exploitation of this vulnerability in conjunction with other vulnerability could allow the attacker to run arbitrary code with elevated privileges.

2. ASLR Security Bypass Vulnerability ( CVE-2014-6339   )

Address Space Layout Randomization (ASLR) moves executable images into random locations when a system boots, which helps prevent an attacker from leveraging data at predictable locations.
A security bypass vulnerability exists in Internet Explorer due to non usage of the Address Space Layout Randomization (ASLR) security feature. A remote attacker could exploit this vulnerability by predicting memory offsets of specific instructions in a given call stack to bypass the ASLR security feature.
This vulnerability in conjunction with other vulnerabilities could lead to further attacks.

3. Multiple Remote Code Execution Vulnerabilities ( CVE-2014-4143   CVE-2014-6337   CVE-2014-6341   CVE-2014-6342   CVE-2014-6343   CVE-2014-6344   CVE-2014-6347   CVE-2014-6348   http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6351   CVE-2014-6353   )

Multiple remote code execution vulnerabilities exist in Microsoft Internet Explorer due to improper accessing of objects in the memory. A remote attacker could exploit these vulnerabilities by enticing the targeted user to visit a malicious website which could result in memory corruption of the targeted system. Successful exploitation of the vulnerabilities could lead to execution of an arbitrary code in the context of the current user.

4. Information Cross Domain Disclosure Vulnerabilities ( CVE-2014-6345   CVE-2014-6346   CVE-2014-6340   )

Multiple information cross domain disclosure vulnerabilities exists in Microsoft Internet Explorer due to improper restriction of cross domain policies. An attacker could exploit these vulnerabilities by convincing the targeted user to visit a specially crafted website. Successful exploitation of the vulnerabilities could lead to disclosure of sensitive information.

5. Clipboard Information Disclosure Vulnerability ( CVE-2014-6323   )

This vulnerability exists in Microsoft Internet Explorer due to insufficient security restrictions to access the clipboard of a user who visits a website. An attacker could exploit this vulnerability by convincing the targeted user to visit a specially crafted website. Successful exploitation of this vulnerability could lead to access of sensitive information from the userss clipboard.

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS14-065

Vendor Information

Microsoft
https://technet.microsoft.com/library/security/ms14-065

References

Microsoft
https://technet.microsoft.com/library/security/ms14-065

CVE Name
CVE-2014-6349
CVE-2014-6350
CVE-2014-6339
CVE-2014-4143
CVE-2014-6337
CVE-2014-6341
CVE-2014-6342
CVE-2014-6343
CVE-2014-6344
CVE-2014-6347
CVE-2014-6348
CVE-2014-6351
CVE-2014-6353
CVE-2014-6323
CVE-2014-6345
CVE-2014-6346
CVE-2014-6340

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India