CVE-2020-0878: Microsoft Browser Memory Corruption Vulnerability

1. In CISA KEVCISA KEV catalogue3 Nov 2021
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>

• Microsoft · ChakraCorebefore publication
• Microsoft · Microsoft Edge (EdgeHTML-based)from 1.0..0 before publication
• Microsoft · Internet Explorer 9from 1.0.0 before publication
• Microsoft · Internet Explorer 11from 1.0.0 before publication

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 3 Nov 2021 · known ransomware use · catalogue entry

Public check

No public nuclei template

Weakness

Out-of-bounds Write · Memory Corruption

Vendor

Microsoft

Published

September 2020

Band

Exploited in the wild, September 2020

1. 5 Nov
   CISA’s KEV entry now notes known ransomware use CISA
2. 3 Nov 2021
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-787cwe.mitre.org
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2portal.msrc.microsoft.com