Microsoft’s Patch Tuesday updates for November 2019 fix over 70 vulnerabilities, including an Internet Explorer flaw that has been exploited in attacks.
The zero-day vulnerability, tracked as CVE-2019-1429, affects the scripting engine used by Internet Explorer 9, 10 and 11. Microsoft describes the security hole as a memory corruption bug that can allow an attacker to execute arbitrary code in the context of the current user by convincing the target to visit a specially crafted website with Internet Explorer or open a malicious Office document.
Microsoft has credited an anonymous researcher working with iDefense Labs, Ivan Fratric of Google Project Zero, Clément Lecigne of Google’s Threat Analysis Group, and Resecurity for reporting the vulnerability.
Google’s Threat Analysis Group has informed Microsoft of several actively exploited Windows and Internet Explorer vulnerabilities in the past year, but information about the attacks is rarely made public. In many cases, however, these flaws were likely exploited in targeted attacks rather than mass exploitation campaigns.
On the other hand, Trend Micro’s Zero Day Initiative (ZDI) has pointed out that other threat groups could also start exploiting CVE-2019-1429 now that they have access to the patch.
ZDI also notes that since the vulnerability can be exploited via malicious Office documents, even users who don’t utilize Internet Explorer are vulnerable to attacks — Microsoft says the attack works if the document hosts the Internet Explorer rendering engine.
SecurityWeek has reached out to both Resecurity and Google to see if they can share any information on the attacks currently exp ..
Support the originator by clicking the read the rest link below.
