# MA-375.022014: MyCERT Advisory - Critical Vulnerability in Microsoft Internet Explorer 9 and 10 Use-After-Free-Vulnerability

**Date:** 21 Feb 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-375.022014  
**Advisory ID:** MA-375.022014

---

**1.0 Introduction**
Microsoft Internet Explorer 9 and Internet Explorer 10 contain a use-after-free vulnerability in the MSHTML CMarkup component, which can allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system.
**2.0 Impact**
The impact of this vulnerability is that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explore.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Microsoft Internet Explorer 10
- Microsoft Internet Explorer 9
**4.0 Recommendations**
> 4.1 Install the Microsoft Fix It Tool.
>
> The tool can be downloaded at:
>
> - <http://support.microsoft.com/kb/2934088>
>
> 4.2 Use the Microsoft Enhanced Mitigation Experience Toolkit workaround. Windows users are advised to add and enhanced EMET support for Internet Explorer (iexplorer.exe). Step by step on how to add the EMET support for specific application can be found in our Protecting Your Windows Computer with Enhanced Mitigation Experience Toolkit (EMET) tutorial at the following URL:
>
> - [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f
>   )
>
> Configure your EMET to protect either
>
> - C:\program files\Internet Explorer\iexplore.exe
> - C:\Program Files (x86)\Internet Explorer\iexplore.exe
>
> 4.3 Upgrade to Internet Explorer 11, can be downloaded at:
>
> - <http://windows.microsoft.com/en-us/internet-explorer/download-ie-MCM>
MyCERT would like to advise the users of Microsoft product to be vigilant of the latest security announcements by Microsoft and ensure that they automatically update the operating systems. The article on how to enable the auto update feature in Microsoft is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#1e73677d7b6c6a5e73677d7b6c6a30716c79307367) or [[email protected]](/cdn-cgi/l/email-protection#eb8892898e99d2d2d2ab8892898e99988e889e99829f92c58692)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- <http://technet.microsoft.com/en-us/security/advisory/2934088>
- <https://www.us-cert.gov/ncas/current-activity/2014/02/20/Microsoft-Releases-Security-Advisory-Internet-Explorer>
- <http://www.kb.cert.org/vuls/id/732479>
- <http://blogs.technet.com/b/srd/archive/2014/02/19/fix-it-tool-available-to-block-internet-explorer-attacks-leveraging-cve-2014-0322.aspx>
- <https://www.mycert.org.my/portal/advisory?id=MA-373.022014>