On January 17, Microsoft published an advisory (ADV200001) warning users about CVE-2020-0674, a remote code execution (RCE) vulnerability involving Microsoft’s Internet Explorer (IE) web browser. A patch has not yet been released as of the time of writing — however, Microsoft has acknowledged that it is aware of limited targeted attacks exploiting the flaw. All supported Windows desktop and Server OS versions can potentially be affected by the bug.
CVE-2020-0674 occurs due to how the scripting engine handles objects in memory in IE. Attackers could exploit this vulnerability to corrupt memory, allowing them to execute arbitrary code in the context of the current user. This can potentially allow an attacker to gain administrative rights if the user is logged on as an administrator. As with other RCE bugs, this means that threat actors could potentially create new accounts, modify data, or even install applications.
Read more…
Source: Trend Micro