IE Zero Day CVE-2013-3897 -- You've been protected for more than a week.

Summary: Cisco Talos's VRT found JavaScript on a popular JS unpacker site that used Math.atan2() calls as debugger breakpoints and deactivated itself unless the User-Agent contained MSIE 8.0 and the browser's systemLanguage was "ko" or "ja". The sample triggers a use-after-free in CDisplayPointer, where a 0x48 byte HeapAlloc is freed and then used, and the VRT's working exploit leverages a ROP chain from hxds.dll, which ships with Microsoft Office.
Why it matters: The exploit's ROP chain draws on hxds.dll, a library installed with Microsoft Office, so the attack surface extended beyond the browser itself. Coverage existed in TRUFFLE rules 28091 and 28092 before a Microsoft advisory appeared, and is now in SIDs 28207 and 28208.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2013-3897
Related: CVE-2013-3897: Microsoft Internet Explorer Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Microsoft Update Tuesday October 2013: Another IE 0-day release Cyber Risks ·
Adobe, Microsoft Push Critical Security Fixes Cyber Risks ·