# MA-388.042014: MyCERT Alert - Vulnerability in Internet Explorer Could Allow Remote Code Execution

**Date:** 28 Apr 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-388.042014  
**Advisory ID:** MA-388.042014

---

**1.0 Introduction**
MyCERT received information from valid sources regarding a new Internet Explorer (IE) zero day exploit, which targets IE9 through IE11. However, this vulnerability is affects IE6 through IE11. The vulnerability is a remote code execution vulnerability that exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated.
This zero-day bypasses both Windows' ASLR and DEP protections. Microsoft has assigned CVE-2014-1776 to the vulnerability and released security advisory to track this issue.
**2.0 Impact**
The impact of this vulnerability is that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explore. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Microsoft Internet Explorer 6
- Microsoft Internet Explorer 7
- Microsoft Internet Explorer 8
- Microsoft Internet Explorer 9
- Microsoft Internet Explorer 10
- Microsoft Internet Explorer 11
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems Service Pack 1
- Windows 7 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
- Windows 8 for 32-bit Systems
- Windows 8 for x64-based Systems
- Windows Server 2012
- Windows RT
- Windows 8.1 for 32-bit Systems
- Windows 8.1 for x64-based Systems
- Windows Server 2012 R2
- Windows RT 8.1
**4.0 Recommendations**
> 4.1 Use the Microsoft Enhanced Mitigation Experience Toolkit version 4.1 workaround. Microsoft officially supports EMET 4.1. Windows users are advised to add and enhanced EMET support for Internet Explorer (iexplorer.exe). Step by step on how to add the EMET support for specific application can be found in our Protecting Your Windows Computer with Enhanced Mitigation Experience Toolkit (EMET) tutorial at the following URL:
>
> [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f
> )
>
> Configure your EMET to protect either
>
> - C:\program files\Internet Explorer\iexplore.exe
> - C:\Program Files (x86)\Internet Explorer\iexplore.exe
>
> Note : EMET 4.1, in the recommended configuration, is automatically configured to help protect Internet Explorer. No additional steps are required.
>
> 4.2 Disable Active Script support in the browser. Active Script can be disabled by referring to the following steps:
>
> On the Tools menu, click Internet Options
>
> Click the Security tab, choose Internet zone and click on Custom Level
>
> Disable the Active Scripting and click OK
>
> 4.3 Another option for the recommendation in 4.3 is to configure the Enhanced Security Configuration for Internet Explorer and set the Internet Security Zone to "High"
>
> 4.4 Unregister VGX.DLL so that applications that render VML will no longer do so once vgx.dll has been unregistered. However, you should re-register vgx.dll after installing the security update when security update is available to address this issue.
>
> 4.5 Modify the Access Control List on VGX.DLL to be more restrictive so that applications and Web sites that render VML may no longer display or function correctly. However, before any security updates that fix this issue can be installed, this workaround must be reverted to the previous ACL configuration for vgx.dll.
>
> 4.6 Enable Enhanced Protected Mode (EPM) For Internet Explorer 11 and Enable 64-bit Processes for Enhanced Protected Mode. This security setting will protect users of Internet Explorer 11 on Windows 7 for x64-based systems, and all Windows 8 and Windows 8.1 clients.
>
> 4.7 Do not browse to untrusted websites or click on untrusted links especially URLs enclosed in e-mails from an unknown sender.
>
> 4.8 Browse the Internet through access of a lower privilege user to minimize the impact of the malicious file.
>
> 4.9 Consider using alternative web browsers to browse the Internet. Please make sure you use the latest version and stay up-to-date as well.
By using EMET may break the exploit in user environment and prevent it from successfully controlling user computer. EMET versions 4.1 and 5.0 (and/or detect) and Enhanced Protected Mode (EPM) in IE breaks the exploit. EPM was introduced in IE10. Additionally, the attack will not work without Adobe Flash. Disabling the Flash plugin within IE will prevent the exploit from functioning.
MyCERT would like to advise the users of Microsoft product to be vigilant of the latest security announcements by Microsoft and ensure that they automatically update the operating systems. The article on how to enable the auto update feature in Microsoft is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, and requires our further analysis, please reach us through the following channels:
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#71120813140348484831120813140302141204031805085f1c08) or [[email protected]](/cdn-cgi/l/email-protection#e68b9f85839492a68b9f85839492c8899481c88b9f)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
**5.0 References**
- <https://www.auscert.org.au/render.html?it=19514>
- <http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html>
- <https://technet.microsoft.com/en-US/library/security/2963983>
- <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1776>