Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

New, Unpatched IE 0 Day published at ZDI

Published: 2014-05-21
Last Updated: 2014-05-21 16:53:23 UTC
by John Bambenek (Version: 1)
4 comment(s)

The Zero Day Initiative has published a new and unpatched IE 0-Day that was originally reported to them (and by extension, Microsoft) in October 2013.  In essence, a victim has to go to a crafted webpage that takes advantage of handling of CMarkup objects which ultimately can be used to execute code with the permissions of the web browser process.  Microsoft says the EMET will mitigate this vulnerability and at least Tipping Point claims protection with their devices.  At this point, there is no indication that it is being used in the wild.  The interesting thing here is the timeline between initial report and there being no patch.

This diary will be updated as the situation warrants.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Bambenek Consulting

Keywords: ie 0day zdi14140
4 comment(s)
Sendmail version 8.14.9 just released, available for download at ftp://ftp.sendmail.org/pub/sendmail/
ISC StormCast for Wednesday, May 21st 2014 http://isc.sans.edu/podcastdetail.html?id=3987
Diary Archives