Windows 10: Scripting Engine Memory Corruption Vulnerability

Brink · Nov 14, 2018

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.

The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.

Exploitability Assessment

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

Publicly Disclosed Exploited Latest Software Release Older Software Release Denial of Service No No 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable
Security Updates

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.

Product Platform Article Download Impact Severity Supersedence Internet Explorer 10 Windows Server 2012 4467701 Monthly Rollup Remote Code Execution Low 4462929 4466536 IE Cumulative Internet Explorer 11 Windows 10 Version 1703 for 32-bit Systems 4467696 Security Update Remote Code Execution Important 4462937 Internet Explorer 11 Windows 10 Version 1703 for x64-based Systems 4467696 Security Update Remote Code Execution Important 4462937 Internet Explorer 11 Windows 10 Version 1803 for 32-bit Systems 4467702 Security Update Remote Code Execution Important 4462919 Internet Explorer 11 Windows 10 Version 1803 for x64-based Systems 4467702 Security Update Remote Code Execution Important 4462919 Internet Explorer 11 Windows 10 Version 1803 for ARM64-based Systems 4467702 Security Update Remote Code Execution Important 4462919 Internet Explorer 11 Windows 10 Version 1809 for 32-bit Systems 4467708 Security Update Remote Code Execution Important 4464330 Internet Explorer 11 Windows 10 Version 1809 for x64-based Systems 4467708 Security Update Remote Code Execution Important 4464330 Internet Explorer 11 Windows 10 Version 1809 for ARM64-based Systems 4467708 Security Update Remote Code Execution Important 4464330 Internet Explorer 11 Windows Server 2019 4467708 Security Update Remote Code Execution Low 4464330 Internet Explorer 11 Windows 10 Version 1709 for 32-bit Systems 4467686 Security Update Remote Code Execution Important 4462918 Internet Explorer 11 Windows 10 Version 1709 for 64-based Systems 4467686 Security Update Remote Code Execution Important 4462918 Internet Explorer 11 Windows 10 Version 1709 for ARM64-based Systems 4467686 Security Update Remote Code Execution Important 4462918 Internet Explorer 11 Windows 10 for 32-bit Systems 4467680 Security Update Remote Code Execution Important 4462922 Internet Explorer 11 Windows 10 for x64-based Systems 4467680 Security Update Remote Code Execution Important 4462922 Internet Explorer 11 Windows 10 Version 1607 for 32-bit Systems 4467691 Security Update Remote Code Execution Important 4462917 Internet Explorer 11 Windows 10 Version 1607 for x64-based Systems 4467691 Security Update Remote Code Execution Important 4462917 Internet Explorer 11 Windows Server 2016 4467691 Security Update Remote Code Execution Low 4462917 Internet Explorer 11 Windows 7 for 32-bit Systems Service Pack 1 4467107 Monthly Rollup Remote Code Execution Important 4462923 4466536 IE Cumulative Internet Explorer 11 Windows 7 for x64-based Systems Service Pack 1 4467107 Monthly Rollup Remote Code Execution Important 4462923 4466536 IE Cumulative Internet Explorer 11 Windows 8.1 for 32-bit systems 4467697 Monthly Rollup Remote Code Execution Important 4462926 4466536 IE Cumulative Internet Explorer 11 Windows 8.1 for x64-based systems 4467697 Monthly Rollup Remote Code Execution Important 4462926 4466536 IE Cumulative Internet Explorer 11 Windows RT 8.1 4467697 Monthly Rollup Remote Code Execution Important 4462926 Internet Explorer 11 Windows Server 2008 R2 for x64-based Systems Service Pack 1 4467107 Monthly Rollup Remote Code Execution Low 4462923 4466536 IE Cumulative Internet Explorer 11 Windows Server 2012 R2 4467697 Monthly Rollup Remote Code Execution Low 4462926 4466536 IE Cumulative Internet Explorer 9 Windows Server 2008 for 32-bit Systems Service Pack 2 4467706 Monthly Rollup Remote Code Execution Low 4463097 4466536 IE Cumulative Internet Explorer 9 Windows Server 2008 for x64-based Systems Service Pack 2 4467706 Monthly Rollup Remote Code Execution Low 4463097 4466536 IE Cumulative
Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

Acknowledgements

Ivan Fratric of Google Project Zero

See acknowledgements for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

Version Date Description 1.0 11/13/2018 Information published. 1.1 11/14/2018 Corrected the CVE title and description to address the vulnerability as remote code execution. In the Affected Products table, corrected the Impact to Remote Code Execution. This is an informational change only.
Click to expand...

Source: https://portal.msrc.microsoft.com/en.../CVE-2018-8552

:)

Brink · Nov 14, 2018

Intel Management Engine Vulnerability and Surface Devices

Microsoft is aware of the Intel Management Engine vulnerability (Intel-SA-00086). The Intel vulnerability detection tool currently lists Microsoft Surface devices as vulnerable to this security advisory.Microsoft has investigated the issue and found the following:

Remote exploit of this vulnerability requires Intel Active Management Technology (AMT). Current Surface devices do not allow remote connectivity to the ME because our devices do not run AMT.

Local exploit of this vulnerability requires Direct Connect Interface (DCI) access via USB, which is not provided on Surface devices.

Because of this, we believe exploits using this vulnerability are significantly reduced on Surface devices. We care deeply about ensuring our devices are reliable and secure and are working with Intel to generate fixes for current devices, which we expect to release in the near future.
Click to expand...

Source: Intel Management Engine Vulnerability and Surface Devices Surface

chaimhaas · Nov 14, 2018

Skype Cross-zone Scripting Vulnerability Found

Skype Security Blog

Skype provides a full description on its Security Blog of the vulnerability and the steps that have been taken to address the problem so it doesn't affect users

Brink · Nov 14, 2018

VulnScan - Automated Triage & Root Cause Analysis of Memory Corruption

The Microsoft Security Response Center (MSRC) receives reports about potential vulnerabilities in our products and it’s the job of our engineering team to assess the severity, impact, and root cause of these issues. In practice, a significant proportion of these reports turn out to be memory corruption issues. In order to root cause these issues, an MSRC security engineer typically needs to analyze the crash and try to understand what went wrong. This workflow isn’t unique to externally reported vulnerabilities; vulnerabilities that are discovered internally through fuzzing and variant investigation are also typically memory corruption issues and these need to be triaged and assessed for exploitability too.

For these reasons, MSRC has made significant investments over the course of many years to build tooling that helps us automate the root cause analysis process. VulnScan is a tool designed and developed by MSRC to help security engineers and developers determine the vulnerability type and root cause of memory corruption bugs. It is built on top of two internally developed tools: Debugging Tools for Windows (WinDbg) and Time Travel Debugging (TTD).

WinDbg is Microsoft's Windows debugger that has recently received a user interface makeover to make it even easier to use. You can find more information about the new WinDbg Preview version here.

Time Travel Debugging is an internally developed framework that records and replays execution of Windows applications. This technology was released during CPPCon 2017.

By leveraging WinDbg and TTD, VulnScan is able to automatically deduce the root cause of the most common types of memory corruption issues. Application Verifier’s mechanism called PageHeap is used to trigger an access violation closer to the root cause of the issue. The analysis starts from the crash location and progresses towards the root cause. Classes of memory corruption issues supported by VulnScan:
Click to expand...

Read more: VulnScan - Automated Triage and Root Cause Analysis of Memory Corruption Issues Defense

Windows 10: Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability - Similar Threads - Scripting Engine Memory

Corrupt script

Internet Explorer Scripting Engine Memory Corruption Vulnerability

CVE-2019-1367 IE11 Scripting Engine Memory Corruption Vulnerability

ADV190021 - Outlook on the web Cross-Site Scripting Vulnerability

Can't find script engine "Jscript" > GXKLoiWHiOpw.js

Memory Corruption

CVE-2018-0986 | Microsoft Malware Protection Engine Vulnerability

Windows Script Hoist - no script engine for file extension .js

Intel Management Engine Vulnerability and Surface Devices

Users found this page by searching for:

how scripting engine objects in memory

scripting engine memory

Scripting Engine Memory CorruptionVulnerability