Microsoft Internet Explorer 8 contains a use-after-free vulnerability in the
CGenericElement object, which is currently being exploited in the wild.
Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10 are not affected by the vulnerability.
This is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
Additional details may be found in the full advisory. A Metasploit module has been released to exploit this vulnerability as well.
A remote unauthenticated attacker may be able to run arbitrary code in the context of the user running Internet Explorer 8.
Apply an Update
If you are unable to upgrade, please consider the following workarounds.
Apply a Microsoft "Fix It"
Microsoft has released a Microsoft "Fix It" solution for this vulnerability. The "Fix It" solution uses the Windows application compatibility toolkit to make a small change at runtime to mshtml.dll every time IE is loaded.
Use the Microsoft Enhanced Mitigation Experience Toolkit
The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will. While still in beta, EMET 4.0 provides additional exploit mitigations that EMET 3.0 does not that will increase the difficulty of exploitation for an adversary.
Enable DEP in Microsoft Windows
Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.
Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Vendor has issued information
__ Sort by: Status Alphabetical
Affected Unknown __ Unaffected
Updated: May 06, 2013
No statement is currently available from the vendor regarding this vulnerability.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector
Base | 9.4 | AV:N/AC:L/Au:N/C:C/I:C/A:N
Temporal | 8.9 | E:H/RL:W/RC:C
Environmental | 6.7 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND
This vulnerability was discovered in the wild.
This document was written by Jared Allar.
CVE IDs: | CVE-2013-1347
Date Public: | 2013-05-03
Date First Published: | 2013-05-06
Date Last Updated: | 2013-05-14 17:28 UTC
Document Revision: | 28