CERT-In Vulnerability Note
CIVN-2014-0271
Remote Code Execution Vulnerability in Microsoft Internet Explorer
Original Issue Date:December 05, 2014
Severity Rating: MEDIUM
Systems Affected
- Windows Server 2003 and x64 Edition SP2
- Windows Vista and x64 Edition SP2
- Windows Server 2008 for 32-bit and x64-based Systems SP2
- Windows 7 for 32-bit and x64-based Systems SP1
- Windows Server 2008 R2 for Itanium-based Systems and x64-based Systems SP1
- Windows 8 and 8.1 for 32-bit and x64-based Systems
- Windows Server 2012 and Windows Server 2012 R2
- Windows RT and Windows RT 8.1
Component Affected
- Internet Explorer 8,9,10 and 11
Overview
A remote code execution vulnerability has been reported in Microsoft Internet Explorer which could allow a remote attacker to execute arbitrary code on the targeted system.
Description
This vulnerability exists in Microsoft Internet Explorer due to use-after-free condition that may occur while improper handling of HTML elements in memory. A remote attacker could exploit this vulnerability by enticing the targeted user to view a specially crafted file containing malicious Cascading Style Sheet (CSS) display:run-in style elements resulting in memory corruption.
Successful exploitation of this vulnerability could allow the remote attacker to execute arbitrary code on the targeted system in the context of currently logged-in user.
Workaround
- Set Internet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
- Install EMET, The Enhanced Mitigation Experience Toolkit (EMET)
References
Zero Day Initiative
http://www.zerodayinitiative.com/advisories/ZDI-14-403/
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=36659
CVE Name
CVE-2014-8967
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|