Microsoft Internet Explorer Remote Code Execution 0-Day (CVE-2019-1367)

Microsoft released an out-of-band patch for a 0-day vulnerability in Internet Explorer yesterday. This memory corruption vulnerability in the Scripting Engine can lead to a Remote Code Execution (RCE) vulnerability, and, as implied by the fact that it’s a 0-day, is being exploited in-the-wild. The Scripting Engine typically represents the most affected software covered by Microsoft's monthly patch release so it's no surprise to find that this is a vulnerability discovered and exploited by bad actors.

The vulnerability would typically be exploited by convincing a victim using Internet Explorer to open a malicious URL. If your clients have automatic updates turned on, you shouldn't have to worry about patch deployment.

Technical details regarding the vulnerability are currently not publicly available, but we are able to confirm that Trustwave Secure Web Gateway (SWG) customers have been protected against attacks exploiting this CVE since Security Update 222 (released Jan 2019). Customers of Secure Email Gateway (SEG) using the Blended Threat Module (BTM) feature are similarly protected against malicious URLs exploiting this vulnerability sent via email.