Trend Micro’s Zero-Day Initiative yesterday released a summary of light technical details regarding a vulnerability in Windows operating system’s JScript component that allows remote hackers to execute malicious code on the victim’s computer.
According to ZDI, the vulnerability can be exploited by targeting installations on Microsoft Windows and requires user interaction by visiting a malicious page or downloading and opening a malicious file on the system.
“The specific flaw exists within the handling of Error objects in JScript,” ZDI said in the advisory. “By performing actions in script, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process.”
ZDI had first reported this vulnerability to Microsoft in January after Dmitri Kaslov of Telspace Systems had discovered the bug and has disclosed the vulnerability to the public according to its 120 day deadline.
Microsoft is reportedly working on a patch but since it was unable to meet ZDI’s deadline, ZDI has disclosed light details of the vulnerability.
Brian Gorenc, director of Trend Micro's Zero Day Initiative, told Bleeping Computer, “Due to the sensitivity of the bug, we don’t want to provide too many technical details until a full fix from Microsoft is available.”
He also said that the flaw does not lead to a full system compromise as it only allows code execution “within a sandbox environment”. "An attacker would need additional exploits to escape the sandbox and execute their code on the target system," he said.
The vulnerability has received a 6.8 CVSS score out of 10.
