Four Zero Day Vulnerabilities Discovered in Internet Explorer!

How many Zero-Days do you think could hit Microsoft today? Neither one nor two; this times its Four.

Hewlett-Packard’s Zero-Day Initiative greeted Microsoft today with not one but four zero day vulnerabilities located in Internet Explorer, allowing hackers to remotely execute a malicious code on target machine. At first it was thought that these vulnerabilities would affect only desktop version of Microsoft’s very own web browser, however later it was reported that even mobile versions are vulnerable.

All the four zero-days originally were reported to Microsoft, affecting Internet Explorer on the desktop. However, later it was discovered that the zero-day vulnerabilities affected Internet Explorer Mobile on Windows Phones as well.

Four Zero-day vulnerabilities Disclosed by ZDI

Here are the zero-day vulnerabilities, as reported by ZDI:

    ZDI-15-359: AddRow Out-Of-Bounds Memory Access Vulnerability
    ZDI-15-360: Use-After-Free Remote Code Execution Vulnerability
    ZDI-15-361: Use-After-Free Remote Code Execution Vulnerability
    ZDI-15-362: Use-After-Free Remote Code Execution Vulnerability

All of them are important discoveries however ZDI-15-359 is the most critical, since it relates to how IE processes arrays representing cells in HTML Tables. Hacker can force IE to use the memory past the end of an array of HTML cells by altering elements of the document itself. This allows attack to execute code under the context of the current process.

The most critical vulnerability out of the four bugs is the AddRow Out-Of-Bounds Memory Access flaw that affects the way Internet Explorer handles some specific arrays.

    "The vulnerability relates to how Internet Explorer processes arrays representing cells in HTML tables," says the advisory issued by the Zero Day Initiative. "By manipulating a document’s elements an attacker can force the Internet Explorer (IE) to use memory past the end of an array of HTML cells. An attacker can leverage this vulnerability to execute code under the context of the current process."

Another vulnerability the company disclosed is a bug in how Internet Explorer handles CAttrArray objects. The vulnerability could allow an attacker to manipulate a document's elements in an attempt to force a free dangling pointer to be reused, leveraging the attacker to execute malicious code on victim's machine.

Microsoft has fixed all the four zero-day vulnerabilities in the desktop version of its browser, but the flaws remain open on Internet Explorer Mobile.

HP's Zero Day Initiative does not slack with its 120-day disclosure policy. It notified Microsoft of the first zero-day flaw on November 12, 2014, and extended the disclosure deadline to May 12, 2015, then again to July 19. However, with no patch forthcoming, ZDI went public on July 22.