# MA-399.052014: MyCERT Alert - Microsoft Internet Explorer 8 CMarkup use-after-free vulnerability

**Date:** 26 May 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-399.052014  
**Advisory ID:** MA-399.052014

---

**1.0 Introduction**
Microsoft Internet Explorer 8 contains a use-after-free vulnerability, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. This can allow for arbitrary code execution. Additional details may be found in the Zero Day Initiative advisory [ZDI-14-140](http://zerodayinitiative.com/advisories/ZDI-14-140/).
**2.0 Impact**
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code. This vulnerability allows attackers to install malware on your computer, should you click on a malicious link or open a malicious email attachment. Such malware can then allow direct access to your files.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Microsoft Internet Explorer 8
**4.0 Recommendations**
4.1 Upgrade Internet Explorer 8 to Internet Explorer 11 as prevention against this vulnerability.
4.2 If you are unable to upgrade to Internet Explorer 11, users may use the following workaround.
Users can use the following detail steps as a temporary workaround against this exploit:
4.2.1 Windows users are advised to add the EMET support for Internet Explorer (iexplorer.exe). Step by step on how to add the EMET support for specific application can be found in our Protecting Your Windows Computer with Enhanced Mitigation Experience Toolkit (EMET) tutorial at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f
)
4.2.2 Disable Active Script support in the browser, configure the Enhanced Security Configuration for Internet Explorer, and set the Internet Security Zone to "High". Referring to the following URL can disable active Script:
- <https://www.mycert.org.my/portal/advisory?id=MA-358.092013>
4.2.3 Do not browse to untrusted websites or click on untrusted links especially URLs enclosed in e-mails from an unknown sender.
4.2.4 Browse the Internet through access of a lower privilege user to minimize the impact of the malicious file.
4.2.5 Users are consider using alternative web browsers to browse the Internet. Please make sure you use the alternative browser is latest version and stay up-to-date as well.
MyCERT would like to advise the users of Microsoft product to be vigilant of the latest security announcements by Microsoft and ensure that they automatically update the operating systems. The article on how to enable the auto update feature in Microsoft is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, and requires our further analysis, please reach us through the following channels:
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#89eaf0ebecfbb0b0b0c9eaf0ebecfbfaeceafcfbe0fdf0a7e4f0) or [[email protected]](/cdn-cgi/l/email-protection#d6bbafb5b3a4a296bbafb5b3a4a2f8b9a4b1f8bbaf)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
**5.0 References**
- <http://zerodayinitiative.com/advisories/ZDI-14-140/>
- <http://www.kb.cert.org/vuls/id/239151>
- <http://xforce.iss.net/xforce/xfdb/92807>
- <http://blog.emsisoft.com/2014/05/22/zero-day-alert-unpatched-vulnerability-in-internet-explorer-8/>