A new Internet Explorer zeroday has surfaced that affects every supported version of Internet Explorer. It has been observed in the wild in targeted attacks in Japan. Current attacks are focusing on exploiting Internet Explorer 8 and 9 on Windows XP and 7 machines.
This is a use-after-free vulnerability in mshtml.dll, which is a DLL used by Windows to present HTML content to the user. The current exploitation vector relies on an extremely common Microsoft Office DLL, hxds.dll, which was compiled without address space layout randomization (ASLR) support. Attackers use DLLs like this to be able to more easily exploit a system, allowing them to execute arbitrary code at will.
To help mitigate this vulnerability, Microsoft has released a Fix it, which can be found here. Additionally, EMET 4.0 can be used to mitigate this vulnerability, as well as others.
Because the Fix it has been released, as well as a detailed blog post by Microsoft discussing the vulnerability, attackers will be able to deduce where the vulnerability lies, which greatly increases the likelihood of seeing this vulnerability exploited in areas outside of Japan. We expect to see this vulnerability incorporated into exploit frameworks in the near future.
The exploitation of this vulnerability is mitigated by built-in memory protections utilized by PowerBroker Endpoint Protection Platform, and is detected by Retina in the following audits:
30541 - Microsoft Internet Explorer MSHTML NULL_IMPORT_DESCRIPTOR (Zero-Day)
30542 - Microsoft Internet Explorer MSHTML NULL_IMPORT_DESCRIPTOR (Zero-Day) - x64
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.
