9.3

CVE-2014-0322

Warnung
Medienbericht
Exploit
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Internet Explorer Version9
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows Server 2008 Version-
   Microsoft ≫ Windows Server 2008 Versionr2
   Microsoft ≫ Windows Vista Version-
Microsoft ≫ Internet Explorer Version10
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 8 Version-
   Microsoft ≫ Windows Rt Version-
   Microsoft ≫ Windows Server 2008 Versionr2
   Microsoft ≫ Windows Server 2012 Version-

04.05.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Internet Explorer Use-After-Free Vulnerability

Schwachstelle

Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 85.24% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx
Broken Link
Permissions Required
http://technet.microsoft.com/security/advisory/2934088
Patch
Vendor Advisory
http://twitter.com/nanoc0re/statuses/434251658344673281
Press/Media Coverage
http://www.exploit-db.com/exploits/32851
Third Party Advisory
Exploit
VDB Entry
http://www.exploit-db.com/exploits/32904
Third Party Advisory
Exploit
VDB Entry
http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html
Broken Link
http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html
Broken Link
http://www.kb.cert.org/vuls/id/732479
Third Party Advisory
US Government Resource
http://www.osvdb.org/103354
Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
Patch
Vendor Advisory
https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip
Exploit
Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0322
US Government Resource