On VBScript

Summary: Google Project Zero used the Domato grammar fuzzing engine to find three new VBScript vulnerabilities, all now fixed, after at least two VBScript 0day attacks (CVE-2018-8174 and CVE-2018-8373) were delivered through Microsoft Office files in 2018. The bugs follow a pattern where evaluating a container member address, then assigning a value that triggers a callback which frees the container storage, results in writing to freed memory; a third bug involves a reference count leak that can overflow a 32-bit counter for built-in classes such as RegExp.
What you should know: Microsoft disabled VBScript execution in Internet Explorer's Internet and Restricted Sites zones by default in the Windows 10 Fall Creators Update, yet attackers still used VBScript 0days in 2018 by routing malicious code through embedded objects in Office files - so the policy did not close the path the exploits actually took.

Read the original at Google Project Zero ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2018-8174 CVE-2018-8373
Related: Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet Explorer Cyber Risks ·
New Wine in Old Bottle: New Azorult Variant Found in Find MyName Campaign using Fallout Exploit Kit Cyber Risks ·
CVE-2018-8373: Microsoft Scripting Engine Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022