CRITICAL Microsoft Corporation Vulnerability Alert

Product:

Internet Explorer

Summary

A use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service through memory corruption. This vulnerability is related to the CMarkup::IsConnectedToPrimaryMarkup function and was actively exploited in April 2014. Microsoft clarified that VGX.DLL does not contain the vulnerable code leveraged in this exploit.

Details

Severity Base Score CVE
CRITICAL 9.8 CVE-2014-1776

Exploitation

To exploit this vulnerability, an attacker can craft a malicious web page that, when visited by a user, triggers the use-after-free condition. This can lead to arbitrary code execution or a denial of service. The attacker may host the malicious page on a website or send it via email, enticing users to interact with it, thereby executing the exploit.

Affected Products

  • Internet Explorer 6: Affected by the use-after-free vulnerability allowing remote code execution.
  • Internet Explorer 7: Vulnerable to exploitation through crafted web content.
  • Internet Explorer 8: Can be exploited via malicious web pages leading to memory corruption.
  • Internet Explorer 9: Susceptible to attacks that leverage the CMarkup function.
  • Internet Explorer 10: Vulnerable to remote code execution through crafted content.
  • Internet Explorer 11: Affected by the same use-after-free vulnerability as previous versions.

Mitigation

To mitigate this vulnerability, users should apply updates as per Microsoft’s instructions. Disabling VGX.DLL is also recommended as a temporary workaround to block known attacks until the updates are applied.

References