# MA-373.022014: MyCERT Alert - New Zero-Day Exploit (CVE-2014-0322)

**Date:** 14 Feb 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-373.022014  
**Advisory ID:** MA-373.022014

---

**1.0 Introduction**
MyCERT received information from valid sources regarding a newly discovered zero day exploit today which targets IE 10 with Adobe Flash. The vulnerability is a previously unknown use-after-free bug in Microsoft Internet Explorer 10, which allows the attacker to modify one byte of memory at an arbitrary address.
**2.0 Impact**
An attacker who successfully exploits this vulnerability will be able to execute codes remotely and gain the same privilege as the user. Unsuccessful attacks may cause denial-of-service (DoS) outcomes. This vulnerability could be exploited to install malware on the user's computer.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Microsoft Internet Explorer 10
**4.0 Recommendations**
As of the writing of this advisory, Microsoft has not released any security patches for this vulnerability. Basically, installing EMET, disabling JavaScript or updating to Internet Explorer 11 prevents this exploit from functioning.
Users can use the following detail steps as a temporary workaround against this exploit:
> 4.1 Windows users are advised to add the EMET support for Internet Explorer (iexplorer.exe). Step by step on how to add the EMET support for specific application can be found in our Protecting Your Windows Computer with Enhanced Mitigation Experience Toolkit (EMET) tutorial at the following URL:
>
> - [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f
>   )
>
> Configure your EMET to protect either
>
> - C:\program files\Internet Explorer\iexplore.exe
> - C:\Program Files (x86)\Internet Explorer\iexplore.exe
>
> 4.2 Disable Active Script support in the browser. Active Script can be disabled by referring to the following steps:
>
> On the Tools menu, click Internet Options:
>
> Click the Security tab, choose Internet zone and click on Custom Level:
>
> Disable the Active Scripting and click OK:
>
> 4.3 Another option for the recommendation in 4.3 is to configure the Enhanced Security Configuration for Internet Explorer and set the Internet Security Zone to "High"
>
> 4.4 Do not browse to untrusted websites or click on untrusted links especially URLs enclosed in e-mails from an unknown sender.
>
> 4.5 Browse the Internet through access of a lower privilege user to minimize the impact of the malicious file.
>
> 4.6 Consider using alternative web browsers to browse the Internet. Please make sure you use the latest version and stay up-to-date as well.
MyCERT would like to advise the users of Microsoft product to be vigilant of the latest security announcements by Microsoft and ensure that they automatically update the operating systems. The article on how to enable the auto update feature in Microsoft is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: https://www.mycert.org.my
**5.0 References**
- [http://www.fireeye.com/blog/uncategorized/2014/02/](http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html)
- <https://www.mycert.org.my/portal/advisory?id=MA-334.092012>
- <http://www.reddit.com/r/netsec/comments/1xuavq/operation_snowman_deputydog_actor_compromises_us/>