New
#1
There are no security updates or workarounds. It seems IE is best avoided but who uses it anymore?
Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
Posted: 14 Nov 2018
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.
Exploitability Assessment
The following table provides an exploitability assessment for this vulnerability at the time of original publication.
Publicly Disclosed Exploited Latest Software Release Older Software Release Denial of Service No No 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable
Security Updates
The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.
Product Platform Article Download Impact Severity Supersedence Internet Explorer 10 Windows Server 2012 4467701 Monthly Rollup Remote Code Execution Low 4462929 4466536 IE Cumulative Internet Explorer 11 Windows 10 Version 1703 for 32-bit Systems 4467696 Security Update Remote Code Execution Important 4462937 Internet Explorer 11 Windows 10 Version 1703 for x64-based Systems 4467696 Security Update Remote Code Execution Important 4462937 Internet Explorer 11 Windows 10 Version 1803 for 32-bit Systems 4467702 Security Update Remote Code Execution Important 4462919 Internet Explorer 11 Windows 10 Version 1803 for x64-based Systems 4467702 Security Update Remote Code Execution Important 4462919 Internet Explorer 11 Windows 10 Version 1803 for ARM64-based Systems 4467702 Security Update Remote Code Execution Important 4462919 Internet Explorer 11 Windows 10 Version 1809 for 32-bit Systems 4467708 Security Update Remote Code Execution Important 4464330 Internet Explorer 11 Windows 10 Version 1809 for x64-based Systems 4467708 Security Update Remote Code Execution Important 4464330 Internet Explorer 11 Windows 10 Version 1809 for ARM64-based Systems 4467708 Security Update Remote Code Execution Important 4464330 Internet Explorer 11 Windows Server 2019 4467708 Security Update Remote Code Execution Low 4464330 Internet Explorer 11 Windows 10 Version 1709 for 32-bit Systems 4467686 Security Update Remote Code Execution Important 4462918 Internet Explorer 11 Windows 10 Version 1709 for 64-based Systems 4467686 Security Update Remote Code Execution Important 4462918 Internet Explorer 11 Windows 10 Version 1709 for ARM64-based Systems 4467686 Security Update Remote Code Execution Important 4462918 Internet Explorer 11 Windows 10 for 32-bit Systems 4467680 Security Update Remote Code Execution Important 4462922 Internet Explorer 11 Windows 10 for x64-based Systems 4467680 Security Update Remote Code Execution Important 4462922 Internet Explorer 11 Windows 10 Version 1607 for 32-bit Systems 4467691 Security Update Remote Code Execution Important 4462917 Internet Explorer 11 Windows 10 Version 1607 for x64-based Systems 4467691 Security Update Remote Code Execution Important 4462917 Internet Explorer 11 Windows Server 2016 4467691 Security Update Remote Code Execution Low 4462917 Internet Explorer 11 Windows 7 for 32-bit Systems Service Pack 1 4467107 Monthly Rollup Remote Code Execution Important 4462923 4466536 IE Cumulative Internet Explorer 11 Windows 7 for x64-based Systems Service Pack 1 4467107 Monthly Rollup Remote Code Execution Important 4462923 4466536 IE Cumulative Internet Explorer 11 Windows 8.1 for 32-bit systems 4467697 Monthly Rollup Remote Code Execution Important 4462926 4466536 IE Cumulative Internet Explorer 11 Windows 8.1 for x64-based systems 4467697 Monthly Rollup Remote Code Execution Important 4462926 4466536 IE Cumulative Internet Explorer 11 Windows RT 8.1 4467697 Monthly Rollup Remote Code Execution Important 4462926 Internet Explorer 11 Windows Server 2008 R2 for x64-based Systems Service Pack 1 4467107 Monthly Rollup Remote Code Execution Low 4462923 4466536 IE Cumulative Internet Explorer 11 Windows Server 2012 R2 4467697 Monthly Rollup Remote Code Execution Low 4462926 4466536 IE Cumulative Internet Explorer 9 Windows Server 2008 for 32-bit Systems Service Pack 2 4467706 Monthly Rollup Remote Code Execution Low 4463097 4466536 IE Cumulative Internet Explorer 9 Windows Server 2008 for x64-based Systems Service Pack 2 4467706 Monthly Rollup Remote Code Execution Low 4463097 4466536 IE Cumulative
Mitigations
Microsoft has not identified any mitigating factors for this vulnerability.
Workarounds
Microsoft has not identified any workarounds for this vulnerability.
Acknowledgements
Ivan Fratric of Google Project Zero
See acknowledgements for more information.
Disclaimer
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions
Version Date Description 1.0 11/13/2018 Information published. 1.1 11/14/2018 Corrected the CVE title and description to address the vulnerability as remote code execution. In the Affected Products table, corrected the Impact to Remote Code Execution. This is an informational change only.
Source: https://portal.msrc.microsoft.com/en.../CVE-2018-8552
Quote
Related Discussions
