CVE-2014-1770: Microsoft IE CMarkup Use-After-Free RCE Vulnerability Analysis

Critical Vulnerability Information Vulnerability Name: (0Day) Microsoft Internet Explorer CMarkup Use-After-Free Remote Code Execution Vulnerability Vulnerability IDs: - ZDI-14-140 - ZDI-CAN-1989 CVE ID: CVE-2014-1770 CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) Affected Vendor: Microsoft Affected Product: Internet Explorer 8 Vulnerability Details Remote attackers can execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required, such as visiting a malicious website or opening a malicious file, to exploit this vulnerability. The specific vulnerability exists in the handling of the CMarkup object. Initial allocation occurs in CMarkup::CreateInitialMarkup. After executing certain JavaScript code, the CollectGarbage call is also processed. By manipulating document elements, attackers can force a dangling pointer to be reused after being freed. Attackers can exploit this vulnerability to execute code within the context of the current process. Mitigation Recommendations In web-based attack scenarios, attackers can create websites specifically designed to exploit these vulnerabilities via Internet Explorer and trick users into visiting them. Users with lower privileges are less affected. By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the Restricted Sites zone. This helps reduce the risk of attackers using these vulnerabilities to execute malicious code. However, if users click on links within email messages, they may still be exploited through web-based attack scenarios. It is recommended to set the security zone settings in Internet Explorer to "High" and block ActiveX controls and Active scripting in these zones. Configure Internet Explorer to prompt before running Active scripts, or disable Active scripting in the Internet and Local zones. Install EMET (Enhanced Mitigation Experience Toolkit) to manage security mitigations, making it harder to exploit vulnerabilities in software. The vendor has released an update to fix this vulnerability. For more details, see: https://technet.microsoft.com/library/security/ms14-035

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2014-1770: Microsoft IE CMarkup Use-After-Free RCE Vulnerability Analysis