Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Microsoft Patches Another Internet Explorer Flaw Exploited in Attacks

Microsoft’s Patch Tuesday updates for November 2019 fix over 70 vulnerabilities, including an Internet Explorer flaw that has been exploited in attacks.

Microsoft’s Patch Tuesday updates for November 2019 fix over 70 vulnerabilities, including an Internet Explorer flaw that has been exploited in attacks.

The zero-day vulnerability, tracked as CVE-2019-1429, affects the scripting engine used by Internet Explorer 9, 10 and 11. Microsoft describes the security hole as a memory corruption bug that can allow an attacker to execute arbitrary code in the context of the current user by convincing the target to visit a specially crafted website with Internet Explorer or open a malicious Office document.

Microsoft has credited an anonymous researcher working with iDefense Labs, Ivan Fratric of Google Project Zero, Clément Lecigne of Google’s Threat Analysis Group, and Resecurity for reporting the vulnerability.

Google’s Threat Analysis Group has informed Microsoft of several actively exploited Windows and Internet Explorer vulnerabilities in the past year, but information about the attacks is rarely made public. In many cases, however, these flaws were likely exploited in targeted attacks rather than mass exploitation campaigns.

On the other hand, Trend Micro’s Zero Day Initiative (ZDI) has pointed out that other threat groups could also start exploiting CVE-2019-1429 now that they have access to the patch.

ZDI also notes that since the vulnerability can be exploited via malicious Office documents, even users who don’t utilize Internet Explorer are vulnerable to attacks — Microsoft says the attack works if the document hosts the Internet Explorer rendering engine.

SecurityWeek has reached out to both Resecurity and Google to see if they can share any information on the attacks currently exploiting CVE-2019-1429.

A dozen other critical vulnerabilities that allow remote code execution have been patched this month by Microsoft, including ones affecting Exchange, Windows, Internet Explorer, and Hyper-V.

Advertisement. Scroll to continue reading.

“Looking through the Critical-rated patches, the updates for Hyper-V stand out the most. Five separate code execution bugs receive patches this month, and each could allow a user on the guest OS to execute code on the underlying host OS,” ZDI said in a blog post.

UPDATE. In a blog post published on Tuesday, Resecurity revealed that CVE-2019-1429 and a previously reported vulnerability, tracked as CVE-2019-0880, are likely exploited by the same threat group.

“We assume both identified 0-day vulnerabilities are related to the tradecraft of the same cyberespionage group focused on APT campaigns against defense, federal and financial sector. The geography of their end targets (victims) is extremely broad and include Middle East, APAC, USA and European Union. Previously, the group was leveraging possible ‘false flag’ attack – that’s why attribution at this moment is fuzzy. We continue to monitor the activity of the group and update our customers and intelligence community about the new previously unknown threats and zero-day vulnerabilities,” says Gene Yoo, CEO of Resecurity.

Related: Microsoft Patches Two Windows Flaws Exploited in Targeted Attacks

Related: Microsoft Patches Internet Explorer Zero-Day Reported by Google

Related: Microsoft Patches Internet Explorer Vulnerability Exploited in Attacks

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.