CVE-2015-0071
Microsoft Internet Explorer ASLR Bypass Vulnerability
Description
CVE-2015-0071 is a security bypass vulnerability in Microsoft Internet Explorer that allows remote attackers to bypass Address Space Layout Randomization (ASLR). By exploiting this flaw through a specially crafted web site, an attacker can discover memory addresses that should be randomized, significantly lowering the barrier to exploiting other memory corruption vulnerabilities in the browser. This Internet Explorer ASLR bypass was used in targeted attack campaigns as part of multi-stage exploitation chains. CISA has listed CVE-2015-0071 in the Known Exploited Vulnerabilities catalog, confirming active exploitation, and its EPSS percentile of 97.2% indicates a very high probability of exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 9; 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- http://www.securityfocus.com/bid/72455(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1031723(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0071(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2015-0071 in the NVD database. The vulnerability allows attackers to bypass ASLR (Address Space Layout Randomization) in Microsoft Internet Explorer via a crafted web site. ASLR randomizes memory addresses to make exploitation more difficult, but this flaw leaks information about the memory layout of the Internet Explorer process, allowing attackers to predict where specific code and data structures reside in memory.
Learn more: CWE Overview
Impact Analysis
CVE-2015-0071 enables ASLR bypass in Microsoft Internet Explorer, weakening a critical memory protection mechanism. While the vulnerability itself does not directly allow code execution, it serves as a critical enabler in exploitation chains. Confidentiality: The vulnerability discloses memory address information through the browser, allowing attackers to map the memory layout of the Internet Explorer process when a user visits a malicious web page. Integrity: By defeating ASLR, the attacker gains the ability to construct reliable exploitation payloads for other memory corruption vulnerabilities in Internet Explorer, turning otherwise unreliable exploits into dependable attacks. Availability: When combined with a code execution vulnerability, the ASLR bypass enables full browser compromise, potentially leading to complete system takeover. With an EPSS percentile of 97.2%, this vulnerability has a very high probability of active exploitation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2015-0071 by listing it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 15, 2022. The EPSS percentile of 97.2% indicates a very high likelihood of exploitation. ASLR bypass vulnerabilities in Internet Explorer are highly prized by attackers because they enable reliable exploitation of the many memory corruption bugs found in the browser engine. CVE-2015-0071 was observed in targeted attack campaigns where it was chained with separate code execution vulnerabilities to achieve reliable remote code execution through web-based attack vectors.
Remediation
- Apply Microsoft security updates per vendor instructions as required by the CISA KEV catalog. Install all relevant patches addressing CVE-2015-0071 in Internet Explorer.
- Migrate away from Internet Explorer to a modern, supported browser such as Microsoft Edge, Google Chrome, or Mozilla Firefox. Microsoft ended Internet Explorer support, and continuing to use it exposes the organization to this and numerous other unpatched vulnerabilities.
- Disable Internet Explorer through Group Policy if migration is not yet complete, to prevent users from inadvertently using the vulnerable browser.
- Enable Enhanced Protected Mode in Internet Explorer if it must remain available temporarily, which provides additional sandbox protections that limit the impact of ASLR bypass.
- Implement network-level protections including web content filtering, DNS-based blocking of known malicious domains, and intrusion prevention system rules to detect exploitation attempts targeting Internet Explorer vulnerabilities.
Technical Details
CVE-2015-0071 is an information disclosure vulnerability in Microsoft Internet Explorer that defeats ASLR (Address Space Layout Randomization). The vulnerability is triggered when a user visits a specially crafted web page that exploits a flaw in how Internet Explorer handles certain operations, leaking memory address information about loaded modules and heap allocations. ASLR is designed to randomize the base addresses of executable modules and memory allocations to make exploitation of memory corruption bugs unpredictable. By defeating this protection, the attacker can determine exact memory addresses needed to construct precision exploitation payloads. The attack is web-based, requiring only that the victim visits a malicious or compromised web page with Internet Explorer. This vulnerability was commonly paired with separate remote code execution vulnerabilities in Internet Explorer, with CVE-2015-0071 providing the ASLR bypass needed to make the code execution exploit reliable.
Frequently Asked Questions
Is CVE-2015-0071 being actively exploited?
Yes, CVE-2015-0071 is actively exploited. CISA confirmed its inclusion in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. The EPSS percentile of 97.2% indicates very high exploitation probability. The vulnerability was used in targeted attack campaigns.
What products are affected by CVE-2015-0071?
CVE-2015-0071 affects Microsoft Internet Explorer. The browser has reached end of life, and Microsoft recommends migrating to Microsoft Edge or another modern browser.
How do I fix CVE-2015-0071?
Apply Microsoft security updates and migrate away from Internet Explorer to a modern browser. If Internet Explorer must remain temporarily, enable Enhanced Protected Mode and disable it for general use through Group Policy.
How severe is CVE-2015-0071?
CVE-2015-0071 is an ASLR bypass vulnerability with an EPSS percentile of 97.2%. While it does not directly enable code execution, it critically weakens memory protections in Internet Explorer, enabling reliable exploitation of other vulnerabilities. Its use in targeted attack campaigns underscores its severity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.