Pierluigi Paganini July 24, 2015

The HP Zero Day Initiative has disclosed four new zero-day vulnerabilities in Internet Explorer that can be exploited by attackers to remotely execute code.

The HP’s Zero Day Initiative has disclosed four new zero-day vulnerabilities in Internet Explorer that can be exploited by attackers to remotely execute code.

The four zero-day flaws affect different components of the browser and are all exploitable through drive-by attacks.

One of the flaws is considered by the experts very critical, it is an AddRow Out-Of-Bounds Memory Access Vulnerability that affects the way that Internet Explorer handles some specific arrays.

According to the advisory issued by the Zero Day Initiative the flaw allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. The experts explained that the flaw affects also Windows Phone. The attack requests the user interaction, targeted users must visit a malicious page or open a malicious file to trigger the exploits.

The vulnerability relates to how Internet Explorer processes arrays representing cells in HTML tables. By manipulating a document’s elements an attacker can force an Internet Explorer to use memory past the end of an array of HTML cells. An attacker can leverage this vulnerability to execute code under the context of the current process.

“The vulnerability relates to how Internet Explorer processes arrays representing cells in HTML tables. By manipulating a document’s elements an attacker can force an Internet Explorer to use memory past the end of an array of HTML cells. An attacker can leverage this vulnerability to execute code under the context of the current process,” states the security advisory issued by ZDI.

That flaw was discovered in November 2014 at the Mobile Pwn2Own contest, ZDI reported it to Microsoft at the time, but the company hasn’t yet fixed it. According to the ZDI policy of disclosing, the Initiative public disclosed the zero-day after 120 days.

In order to mitigate the attack, ZDI suggests to configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

Another critical vulnerability of the set of flaws disclosed by ZDI there is a flaw related the way Internet Explorer handles some objects.

Also, this vulnerability is exploitable to execute arbitrary code remotely and requests the user interaction for its exploitation.

“The specific flaw exists within the handling of CAttrArray objects. By manipulating a document’s elements an attacker can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process,” states the advisory. 

The remaining two vulnerabilities are quite similar, they are related to the IE mishandling CTreePos and CCurrentStyle objects in some circumstances.

Let’s wait for a fix from Microsoft.

Pierluigi Paganini

(Security Affairs – Microsoft Internet Explorer, zero-day)