Microsoft Internet Explorer MSHTML CMarkup释放后重用漏洞

详细信息

漏洞类型

资源管理错误

漏洞描述

Internet Explorer（IE）是美国微软（Microsoft）公司开发的一款Web浏览器，是Windows操作系统附带的默认浏览器。Microsoft Internet Explorer 9和10中的释放后使用漏洞允许远程攻击者通过涉及精心编制的JavaScript代码、CMarkup和脚本元素的onpropertychange属性的向量执行任意代码。

修复建议

1、安装Microsoft修复程序Microsoft Security Advisory (2934088) 已发布来描述此问题。此建议引用修复实用程序来解决此漏洞。http://technet.microsoft.com/en-us/security/advisory/2934088 http://blogs.technet.com/b/srd/archive/2014/02/19/fix-it-tool-available-to-block-internet-explorer-attacks-leveraging-cve-2014-0322.aspx也请考虑下列解决方案： 2、使用Microsoft增强的缓解体验工具包Microsoft增强的缓解体验工具包（EMET）可用于帮助防止利用此漏洞。请注意，不支持ASLR的平台（如Windows XP和Windows Server 2003）将无法获得与现代Windows平台相同的保护级别。http://support.microsoft.com/kb/2458544 3、更新至InternetExplorer11 针对此漏洞的公开攻击不适用于Internet Explorer 11。

参考链接

• https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip

  NVD · x_refsource_MISC

• http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html

  NVD · x_refsource_MISC

• http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html

  NVD · x_refsource_MISC

• http://twitter.com/nanoc0re/statuses/434251658344673281

  NVD · x_refsource_MISC

• http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx

  NVD · x_refsource_MISC

• http://www.exploit-db.com/exploits/32851

  NVD · exploit · x_refsource_EXPLOIT-DB

• http://www.exploit-db.com/exploits/32904

  NVD · exploit · x_refsource_EXPLOIT-DB

• http://technet.microsoft.com/security/advisory/2934088

  NVD · x_refsource_CONFIRM

• http://www.kb.cert.org/vuls/id/732479

  NVD · third-party-advisory · x_refsource_CERT-VN

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012

  NVD · vendor-advisory · x_refsource_MS

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0322

  NVD · US Government Resource