Autor: Jozef Džama
The US Computer Emergency Readiness Team
US-CERT strives for a safer, stronger Internet for all Americans by responding to major incidents, analyzing threats, and exchanging critical cybersecurity information with trusted partners around the world.
Microsoft Internet Explorer contains a use-after-free vulnerability, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Low-level inspection of the mentioned vulnerability places it into a class that accounts for a large number of recently-discovered IE exploits called “Use After Free”. Such vulnerabilities are usually caused by active JavaScript code embedded inside HTML files that allocate objects and reference them inside the context, only to afterwards free the memory location at which the object resides, without checking if the location still has variables pointing towards it.
This particular vulnerability is being exploited in the wild. Although no Adobe Flash vulnerability appears to be at play here, the Internet Explorer vulnerability is used to corrupt Flash content in a way that allows ASLR to be bypassed via a memory address leak. This is made possible with Internet Explorer because Flash runs within the same process space as the browser. Note that exploitation without the use of Flash may be possible.
Questions? 
By Jozef Džamal Džama
