Patchfirst
Patchfirst
CVE-2019-0609 EPSS 9.8%

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…

Microsoft · Internet Explorer 11

Summary

A remote code execution flaw exists in how the scripting engine handles objects in memory in Microsoft browsers, affecting Microsoft's Internet Explorer 11. An attacker can achieve code execution through memory corruption.

Official description · CVE.org

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

Breakdown
19.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
6/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

  3. What can follow

Disclosed on 8 Apr 2019. No public exploit code or confirmed exploitation is recorded.

techniques

8 , grouped by in kill-chain order 8

Initial AccessTA0001

Phishing T1566
MITRE CTID mapping of the CVE · how it is exploited

ExecutionTA0002

Malicious File T1204.002
MITRE CTID mapping of the CVE · how it is exploited
Hijack Execution Flow T1574 also Stealth
MITRE CTID mapping of the CVE · primary impact

PersistenceTA0003

Create Account T1136
MITRE CTID mapping of the CVE · follow-on activity

CollectionTA0009

Data from Local System T1005
MITRE CTID mapping of the CVE · follow-on activity

ImpactTA0040

Data Destruction T1485
MITRE CTID mapping of the CVE · follow-on activity
Application or System Exploitation T1499.004
MITRE CTID mapping of the CVE · primary impact
Data Manipulation T1565
MITRE CTID mapping of the CVE · follow-on activity

Detection

0 rules for this CVE · 104 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-0609 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

PhishingT156614 general rules
All 14 on SigmaHQ ↗
Malicious FileT1204.00239 general rules
All 39 on SigmaHQ ↗
Hijack Execution FlowT15748 general rules
Application or System ExploitationT1499.0043 general rules
Create AccountT11363 general rules
Data from Local SystemT100514 general rules
All 14 on SigmaHQ ↗
Data DestructionT148520 general rules
All 20 on SigmaHQ ↗
Data ManipulationT15653 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.

NuGetMicrosoft.ChakraCoreGHSA-pjpj-f6r8-56rm

Upgrade to 1.11.11 or later

Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).

Set the version to 1.11.11 or later in your .csproj.

First fixed in 1.11.7 for CVE-2019-0609.

Affected versions

If you runUpgrade to
All versions before 1.11.71.11.11first fix for this CVE: 1.11.7

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

x_refsource_CONFIRM 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0609
↑ ↓ chooseEnter openEsc close