Internet Explorer 0day: CVE-2014-1776

Over the weekend, on April 26, Microsoft released an advisory about an Internet Explorer use-after-free zeroday vulnerability, CVE-2014-1776, that is being exploited in the wild. The vulnerability lies within MSHTML.dll, and affects Internet Explorer 6 through 11. According to FireEye, attacks have been spotted in the wild targeting Internet Explorer 9 through 11. The observed attacks rely on an exploit for Adobe Flash, which targets a now patched vulnerability, CVE-2014-0515. Exploiting the Flash vulnerability allowed attackers to bypass ASLR and DEP (security protection mechanisms). Microsoft has released an out-of-band patch to address this vulnerability, MS14-021. Install this patch as soon as possible to address this vulnerability. To mitigate this vulnerability, users are encouraged to apply the following workarounds until the patch can be applied. • Configure EMET 4.1 or 5.0 to protect Internet Explorer. This was observed to mitigate exploitation of this vulnerability. • Use Enhanced Protected Mode in IE (available in 10 and higher). • Upgrade the Flash browser plugin to 13.0.0.206 for Windows/Mac and 11.2.202.356 for Linux. • If you are unable to upgrade Flash, then disable the Flash browser plugin. Retina has audits available to detect vulnerable Internet Explorer and Flash player installations: • 33939 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE6 XP32 • 33940 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE6 XP64/2K3/2K364 • 33941 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE6 XP64/2K364 x64 • 33942 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE7 • 33943 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE7 x64 • 33944 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE8 XP/2003 • 33945 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE8 XP/2003 x64 • 33946 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE8 • 33947 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE8 x64 • 33948 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE9 • 33949 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE9 x64 • 33950 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE10 • 33951 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE10 x64 • 33952 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE11 • 33953 - Microsoft Internet Explorer Use-After-Free (KB2965111) - IE11 x64 • 33877 - Adobe APSB14-13: Flash Player - IE for Windows XP/2003/Vista/2008/7 • 33878 - Adobe APSB14-13: Flash Player - IE for Windows 8/2012/8.1/2012 R2 • 33879 - Adobe APSB14-13: Flash Player - Other Browsers for Windows • 33880 - Adobe APSB14-13: Flash Player - Linux • 33881 - Adobe APSB14-13: Flash Player - Mac OS X Revisions 2014-04-29: Original Post 2014-05-01: Added Notice of Out-Of-Band Patch Release, MS14-021 2014-05-01: Removed Zero-Day audit 33867. 2014-05-01: Added KB2965111 audits.