CVE-2017-0149
Microsoft Internet Explorer Memory Corruption Vulnerability
Description
CVE-2017-0149 is a memory corruption vulnerability in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code or cause a denial-of-service (DoS) condition through a specially crafted website. The vulnerability occurs when Internet Explorer improperly handles objects in memory, enabling code execution in the context of the current user. An attacker who successfully exploits CVE-2017-0149 could take control of the affected system if the user has administrative privileges. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, and the EPSS percentile of 97.3% indicates a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 9; 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/96724(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038008(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0149(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0149(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 describes a weakness where a product writes data past the end or before the beginning of the intended memory buffer. In CVE-2017-0149, Internet Explorer's rendering engine incorrectly handles objects in memory during the processing of crafted web content, leading to memory corruption that an attacker can leverage to redirect execution flow and achieve arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2017-0149 is remotely exploitable through a crafted website, requiring user interaction in the form of navigating to a malicious page or clicking a link. No authentication is needed to trigger the vulnerability. Upon successful exploitation, an attacker gains code execution in the context of the current user, which means the impact on confidentiality, integrity, and availability depends on the user's privilege level. If the user has administrative rights, the attacker could gain full control of the system, install programs, modify data, or create new accounts. The EPSS percentile of 97.3% reflects very high exploitation activity, and CISA's inclusion of CVE-2017-0149 in the KEV catalog confirms that this Internet Explorer memory corruption vulnerability has been actively exploited in real-world attacks.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-0149 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 97.3% indicates very high real-world exploitation probability. Internet Explorer memory corruption vulnerabilities like CVE-2017-0149 have historically been popular targets in exploit kits and watering hole attacks, as they require only that the victim visits a crafted web page. The availability of detailed technical information following the patch release enabled rapid development of exploit code by threat actors and security researchers alike.
Remediation
- Apply the relevant Microsoft security updates as specified by the vendor. This is the required action per CISA's KEV catalog entry for CVE-2017-0149.
- Migrate away from Internet Explorer to a modern, supported browser such as Microsoft Edge, Google Chrome, or Mozilla Firefox, as Internet Explorer has reached end of life and no longer receives security updates.
- If Internet Explorer must remain in use temporarily, configure Enhanced Security Configuration (ESC) and restrict Internet Explorer to trusted sites only through Group Policy.
- Deploy network-level protections such as web content filtering and intrusion prevention systems (IPS) with signatures for known Internet Explorer exploit patterns to block exploitation attempts.
- Educate users about the risks of clicking links from untrusted sources and implement email security gateways that can detect and block phishing emails containing malicious URLs.
Technical Details
CVE-2017-0149 is a memory corruption vulnerability in the Internet Explorer scripting engine. When Internet Explorer processes specially crafted web content, the rendering engine improperly handles objects in memory, resulting in memory corruption classified under CWE-787 (Out-of-bounds Write). This memory corruption can be leveraged by an attacker to overwrite critical data structures, redirect program execution flow, and achieve arbitrary code execution within the security context of the current user. The attack vector is network-based, requiring the victim to visit a malicious website, but the exploitation complexity is low as no special conditions beyond user navigation are required. The vulnerability affects the core memory management of Internet Explorer's scripting engine, making it exploitable across multiple versions of the browser present in various Windows releases.
Frequently Asked Questions
Is CVE-2017-0149 being actively exploited?
Yes, CVE-2017-0149 has been actively exploited in the wild. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 97.3% indicates very high exploitation probability, consistent with the historical use of Internet Explorer memory corruption vulnerabilities in exploit kits and targeted attacks.
What products are affected by CVE-2017-0149?
CVE-2017-0149 affects Microsoft Internet Explorer. Multiple versions of Internet Explorer across various Windows platforms are vulnerable, including Internet Explorer 9, 10, and 11 on supported Windows operating systems at the time of disclosure.
How do I fix CVE-2017-0149?
Apply the Microsoft security update that addresses CVE-2017-0149. The most effective long-term remediation is to migrate away from Internet Explorer entirely, as it has reached end of life. See the Remediation section for detailed mitigation steps.
How severe is CVE-2017-0149?
CVE-2017-0149 is a memory corruption vulnerability that enables remote code execution through a crafted website. With an EPSS percentile of 97.3%, it has a very high exploitation probability. The severity depends on the privileges of the logged-in user, but exploitation can lead to complete system compromise when run under an administrative account.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.