Microsoft tries again to plug exploited IE zero-day

Microsoft has fixed a critical vulnerability in the Internet Explorer web browser for its Windows operating system, which the company said in January was being exploited in the wild and which appears to be a carry-over from September last year.

This is Microsoft's third try at fixing the memory corruption flaw in the Windows Scripting Engine component used by Internet Explorer, Google Project Zero security engineer Maddie Stone said.

CVE-2020-0674 is patched today after in-the-wild exploitation detected by @_clem1 of Google TAG. This is now the 3rd attempt to patch this bug after 2 misfixes (CVE-2019-1367/CVE-2019-1429). We have to fix these bugs the 1st time, especially when they've been exploited itw.

— Maddie Stone (@maddiestone) February 11, 2020

An attacker can exploit the CVE-2020-0674 vulnerability remotely to execute arbitrary code with the same privileges as the user.

Neither Microsoft nor Google have revealed where and when the exploitation attempts took place.

A second criticial memory corruption bug in the Scripting Engine, CVE-2020-0673, that could be exploited remotely as well is also taken care of by Microsoft's set of security patches for this month.

The February 2020 Patch Wednesday collection contains a large amount of fixes for vulnerabilities, 99 in total.

Of these, 12 are rated as critical, and 17 allow for remote code execution.

Four vulnerabilities in Microsoft's Remote Desktop client, services and protocol are also fixed.

Two, CVEs 2020-0681 and 2020-0734 in the Remote Desktop client, were labelled by Microsoft as critical with a warning of "exploitation more likely".

Attackers could exploit the flaws through malicious servers, to remotely run code on connecting RDP clients.

Apart from Internet Explorer, Patch Wednesday contains bugs fixes for flaws that affect the newer versions of the Windows and Windows Server operating systems and components for these such as the Edge web browser and the Malicious Software Removal Tool.

Microsot's Office productivity suite also receives fixes, along with the Exchange mail and calendaring server software and the SQL Server database.