# MA-391.052014: MyCERT Advisory - Critical Security Update to Address Vulnerability in Internet Explorer That Could Allow Remote Code Execution

**Date:** 02 May 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-391.052014  
**Advisory ID:** MA-391.052014

---

**1.0 Introduction**
Microsoft has released out-of-band updates to address a critical vulnerability in Internet Explorer versions 6 through 11, including IE versions running on Windows XP.
This security update resolves a publicly disclosed vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using an affected version of Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
More Information on this vulnerability is available at:
- <https://www.mycert.org.my/portal/advisory?id=MA-388.042014>
This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
**2.0 Impact**
The impact of this vulnerability is that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explore.
**3.0 Affected Products**
The list of the vulnerable products and versions are as below:
- Internet Explorer 6
- Internet Explorer 7
- Internet Explorer 8
- Internet Explorer 9
- Internet Explorer 10
- Internet Explorer 11
**4.0 Recommendations**
Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.
Microsoft Knowledge Base Article 294871 :
- <https://support.microsoft.com/kb/294871>
For Customers who do not have automatic updating enabled, the steps in Turn automatic updating on or off can be used to enable automatic updating.
Turn Automatic Updating :
- <http://windows.microsoft.com/en-us/windows/turn-automatic-updating-on-off#turn-automatic-updating-on-off=windows-8>
More information for the fixes, please refer to Microsoft Security Bulletin MS14-021 at :
- <https://technet.microsoft.com/en-us/library/security/ms14-021.aspx>
MyCERT would like to advise the users of Microsoft product to be vigilant of the latest security announcements by Microsoft and ensure that they automatically update the operating systems.
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated :
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. For any further queries, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#3855415b5d4a4c7855415b5d4a4c16574a5f165541) or [[email protected]](/cdn-cgi/l/email-protection#34574d5651460d0d0d74574d56514647515741465d404d1a594d)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- <https://technet.microsoft.com/en-us/library/security/ms14-021.aspx>
- <https://www.us-cert.gov/ncas/current-activity/2014/05/01/Microsoft-Releases-Security-Update-Internet-Explorer-Use-After-Free>
- <http://www.auscert.org.au/render.html?it=19561>
- <https://www.mycert.org.my/portal/advisory?id=MA-388.042014>