Zero-day flaws in Internet Explorer and Exchange patched by Microsoft

Exploit code is known to be in circulation for both vulnerabilities

Two zero-day flaws affecting Internet Explorer and Exchange have been fixed by Microsoft as part of its weekly 'Patch Tuesday' update rollout. Both vulnerabilities were known to have exploit code in circulation.

One of the patches addressed an "important" privilege elevation flaw in Microsoft Exchange Server that could be used to gain administrative control over an Exchange server via a relatively straightforward man-in-the-middle attack. It was first revealed last month by security researchers, with proof-of-concept exploit code to accompany it.

Patches have been issued for Exchange Server 2010, 2013, 2016 and 2019. Microsoft's advisory warned that the vulnerability - which is designated as CVE-2019-0686 - warned that although no active exploits had been detected in the wild, exploits were likely.

The second issue relates to Internet Explorer and the way it handles objects in memory. Unlike the Exchange flaw, this vulnerability was not disclosed but was discovered by Google's Project Zero researchers being actively exploited in the wild.

"An attacker who successfully exploited this vulnerability could test for the presence of files on disk," Microsoft's advisory warned. "For an attack to be successful, an attacker must persuade a user to open a malicious website."

The flaw - CVE-2019-0676 - affects Internet Explorer versions 10 and 11 on all supported platforms, including Windows Server 2012, 2016 and 2019.

Along with these issues, this week's Patch Tuesday saw fixes for products including Edge, Windows, .NET Framework, Visual Studio Code and the ever-updated Adobe Flash Player.

IT administrators should take note of the patches and work to apply them as the vulnerabilities are now out in the public's eye and thus potentially ripe for hackers to exploite them if they aren't fixed. 

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

Microsoft cracks down on sophisticated BEC scam campaign
scams

Microsoft cracks down on sophisticated BEC scam campaign

20 Jul 2021
Security researchers uncover more Print Spooler vulnerabilities
vulnerability

Security researchers uncover more Print Spooler vulnerabilities

19 Jul 2021
Microsoft customers will be able to record, report, and reduce their emissions
cloud computing

Microsoft customers will be able to record, report, and reduce their emissions

14 Jul 2021
Microsoft unveils Windows 365 ‘Cloud PC’ service
cloud computing

Microsoft unveils Windows 365 ‘Cloud PC’ service

14 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
IT Pro Panel: Why IT leaders need soft skills
professional development

IT Pro Panel: Why IT leaders need soft skills

26 Jul 2021