Memory corruption in Microsoft products - CVE-2016-0189

Vulnerability identifier: #VU5077

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-0189

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Microsoft JScript
VBScript
Microsoft Internet Explorer

Install update from vendor's website.

• Exploit #2252 - cve-2016-0189 (Proof-of-Concept exploit for CVE-2016-0189 (VBScript Memory Corruption in IE11)) (April 1, 2020)
• Exploit #824 - Microsoft Internet Explorer 11 (Windows 10) - VBScript Memory Corruption (PoC) (MS16-051) (March 18, 2020)
• Exploit #1659 - Internet Explorer 11 VBScript Engine Memory Corruption (March 18, 2020)

• https://technet.microsoft.com/en-us/library/security/ms16-051.aspx
• https://technet.microsoft.com/en-us/library/security/ms16-053.aspx

• Multiple vulnerabilities in Microsoft Internet Explorer
• Two remote code execution vulnerabilities in Microsoft JScript and VBScript
• Scripting Engine Memory Corruption Vulnerability
• Security Update for JScript and VBScript