Critical Security Flaws Affect Windows and Internet Explorer
The Department of Homeland Security (DHS) and Cybersecurity and Infrastructure Security Agency (CISA) issued an alert warning users of two critical security flaws in Microsoft products. The two zero-day vulnerabilities impact users of Internet Explorer and multiple versions of the Windows operating system. These security flaws could allow a threat actor to remote control a Windows computer, says CISA in the bulletin.
The security flaws are listed in the Common Vulnerabilities and Exposures database as CVE-2020-1380 and CVE-2020-1464. CVE-2020-1380 could corrupt and affect system memory and allow an attacker to execute code.
Both of these exploits are classified as zero-day flaws meaning there is no solution For them at this time.
Scripting Engine Memory Corruption Vulnerability (CVE-2020-1380)
Scripting Engine Memory Corruption Vulnerability (CVE-2020-1380) is a remote code execution (REC) vulnerability affecting Internet Explorer 11. It affects 32 versions of Internet Explorer 11 including 32-bit systems, 64-bit systems, and Windows Server.
“An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system,” says Microsoft’s Security Advisory.
It’s possible to exploit this vulnerability through a specially crafted website. Then If a target viewed the malicious website their machine could be compromised.
Microsoft has not identified any workarounds or mitigations for this vulnerability.
Windows Spoofing Vulnerability (CVE-2020-1464)
Windows Spoofing Vulnerability (CVE-2020-1464) is a spoofing vulnerability that affects multiple Windows 10 products. The flaw impacts 58 versions of Internet Windows 10 including 32-bit systems, 64-bit systems, and Windows Server (Server Core installation).
“A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files,” says Microsoft’s Security Advisory.
Microsoft has not identified any workarounds or mitigations for this vulnerability.
