Microsoft fixed new critical rated vulnerability in IE browser
Attackers could exploit the vulnerability by hosting an exploit on a website .
On Tuesday May 8, 2018 Microsoft released patches for two Windows vulnerabilities, that according to researchers allow attackers to install malicious apps on the computers of unwitting users.
The first vulnerability is in the VBScript Engine included in all currently supported versions of Windows. When Windows users are logged in as the admin, attackers could take complete control of the system. In the event users are logged in as a standard user with limited rights, attackers may be able to exploit separate vulnerabilities.
CVE-2018-8174, discovered by antivirus provider Kaspersky Lab reported observing the following exploit:
- Targets receive a malicious RTF Microsoft Office document
- After being opened, the malicious document causes the second stage of the exploit to be downloaded in the form of an HTML page with malicious code
- The malicious code triggers the use-after-free memory-corruption bug
- Accompanying shellcode then downloads and executes a malicious payload
Kaspersky Lab security researcher Anton Ivanov wrote the following in an email:
This technique, until fixed, allowed criminals to force Internet Explorer to load, no matter which browser one normally used–further increasing an already huge attack surface... We urge organizations and private users to install recent patches immediately, as it won't be long before exploits to this vulnerability make it to popular exploit kits and will be used not only by sophisticated threat actors but also by standard cybercriminals.
In an advisory published Tuesday , Microsoft officials indicated attackers could also exploit the vulnerability by hosting an exploit on a website or in website ads and tricking a target to view the malicious content with the IE browser. Microsoft is rating CVE-2018-8174 as a "critical," which is the company's highest severity rating.
Microsoft fixed new critical rated vulnerability in IE browser.
