Zero-day flaws in Internet Explorer and Exchange patched by Microsoft

Exploit code is known to be in circulation for both vulnerabilities

Two zero-day flaws affecting Internet Explorer and Exchange have been fixed by Microsoft as part of its weekly 'Patch Tuesday' update rollout. Both vulnerabilities were known to have exploit code in circulation.

One of the patches addressed an "important" privilege elevation flaw in Microsoft Exchange Server that could be used to gain administrative control over an Exchange server via a relatively straightforward man-in-the-middle attack. It was first revealed last month by security researchers, with proof-of-concept exploit code to accompany it.

Advertisement - Article continues below

Patches have been issued for Exchange Server 2010, 2013, 2016 and 2019. Microsoft's advisory warned that the vulnerability - which is designated as CVE-2019-0686 - warned that although no active exploits had been detected in the wild, exploits were likely.

The second issue relates to Internet Explorer and the way it handles objects in memory. Unlike the Exchange flaw, this vulnerability was not disclosed but was discovered by Google's Project Zero researchers being actively exploited in the wild.

"An attacker who successfully exploited this vulnerability could test for the presence of files on disk," Microsoft's advisory warned. "For an attack to be successful, an attacker must persuade a user to open a malicious website."

The flaw - CVE-2019-0676 - affects Internet Explorer versions 10 and 11 on all supported platforms, including Windows Server 2012, 2016 and 2019.

Advertisement
Advertisement - Article continues below

Along with these issues, this week's Patch Tuesday saw fixes for products including Edge, Windows, .NET Framework, Visual Studio Code and the ever-updated Adobe Flash Player.

IT administrators should take note of the patches and work to apply them as the vulnerabilities are now out in the public's eye and thus potentially ripe for hackers to exploite them if they aren't fixed. 

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Microsoft won't reopen its offices until January 2021
Business operations

Microsoft won't reopen its offices until January 2021

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
Labour Party donors caught up in Blackbaud data breach
data breaches

Labour Party donors caught up in Blackbaud data breach

31 Jul 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020