Micorosft Update Tuesday: March 2014, all about IE (including two 0-day fixes)
Summary: Microsoft's March 2014 Update Tuesday shipped 5 bulletins covering 23 CVEs, 18 of them in Internet Explorer, including fixes for two 0-day use-after-free vulnerabilities. CVE-2014-0322 had been publicly known and under targeted attack since February 14 in a watering hole attack at vfw.org, while CVE-2014-0324 saw very limited targeted attacks against IE8.
Key Takeaway: One of the patched IE flaws was already being used in a watering hole attack against a real site for roughly a month before the formal fix, and a separate SAMR flaw (CVE-2014-0317) lets an attacker brute-forcing passwords bypass the account lockout feature and keep guessing.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-0301CVE-2014-0317CVE-2014-0319CVE-2014-0322CVE-2014-0323CVE-2014-0324
- Related
- CVE-2014-0322: Microsoft Internet Explorer Use-After-Free Vulnerability Known Exploited Vulnerabilities · May 04, 2022