Google releases details, PoC exploit code for IE, Edge flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0037 | Type Confusion RCE in Microsoft Internet Explorer and Edge CVE-2017-0037 is a type confusion flaw (CWE-843) in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, located in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function of mshtml.dll. It is triggered when the browser processes a crafted Cascading Style Sheets token sequence combined with JavaScript that operates on a TH (table header) element, typically delivered via a malicious or compromised web page. An attacker who successfully exploits it can execute arbitrary code in the context of the browser process. Any user running the affected legacy Microsoft browsers is exposed, which historically meant most Windows desktops. The flaw was publicly disclosed via Google Project Zero after a 90-day deadline passed, public proof-of-concept exploits are available, and it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), confirming in-the-wild exploitation. Do: Apply Microsoft security updates per vendor instructions (the flaw was addressed in Microsoft's March 2017 Patch Tuesday, which followed the Project Zero disclosure), prioritizing systems in CISA KEV scope. Inventory for any hosts still running IE 10/11 or legacy (pre-Chromium) Edge and retire or isolate them, as legacy Microsoft browsers are end-of-life. As an interim mitigation, avoid using affected browsers for untrusted web content, since exploitation requires rendering attacker-crafted CSS/JavaScript. | 8.1 | 80% | KEV PoC ×5 |
| massHundreds of millions of Windows endpoints (IE 11 and legacy Edge were bundled with Windows 7/8.1/10) |
Full article222 words · extracted from helpnetsecurity.com · click to collapse
As we’re impatiently waiting for Microsoft to patch vulnerabilities that were scheduled to be fixed in February, Google has released details about a serious vulnerability in the Internet Explorer and Edge browsers.
What’s more, the report also contains POC code that, if implemented in web pages, should crash vulnerable browsers. Savvy attackers could perhaps use it as a first step of an attack that could ultimately result in remote code execution.
But Google Project Zero security researcher Ivan Fratric, who reported the flaw, refused to comment more on its exploitability.
“The report has too much info on that as it is (I really didn’t expect this one to miss the deadline),” he noted.
The bug report became automatically visible to the public three days ago, when Google’s customary 90 day disclosure deadline was passed.
The flaw has been assigned the following identifier: CVE-2017-0037. Hopefully Microsoft will plug it in March, along with the other flaws that are awaiting fixes.
Microsoft has postponed the release of the patches scheduled for February 2017 Patch Tuesday because of a last minute issue that could not be resolved in time for the planned updates.
The March 2017 Patch Tuesday is scheduled for March 14. It is still unknown whether Microsoft plans to plug the two other zero-day vulnerabilities for which exploit code has already been published.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/02/27/ie-edge-poc-exploit-code/