Microsoft Edge memory corruption

Summaryinfo

A vulnerability was found in Microsoft Edge. It has been declared as critical. The affected element is an unknown function. The manipulation results in memory corruption. This vulnerability is identified as CVE-2019-0779. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft Edge (Web Browser) (version now known). It has been classified as critical. Affected is some unknown processing. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.

The bug was discovered 03/12/2019. The weakness was released 03/12/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated with the vendor. This vulnerability is traded as CVE-2019-0779 since 11/26/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 05/16/2020). The advisory points out:

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 91509 (Microsoft Edge Security Update for March 2019).

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-131617, VDB-131622, VDB-131624 and VDB-131625. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Edge

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion