Rule Category

BROWSER-IE -- Snort has detected traffic known to exploit vulnerabilities present in the Internet Explorer browser, or products that have the Trident or Tasman engines.

Alert Message

BROWSER-IE Microsoft Internet Explorer 11 JScript use-after-free attempt

Rule Explanation

This event is generated when a user using Microsoft Internet Explorer 11 accesses a page where JavaScript modifies a variable that is reused when not handled by garbage collection. Impact: Attempted User Privilege Gain Details: CVE-2018-8267 is a use after free vulnerability in the Jscript scripting engine (jscript.dll) of Windows. The root cause is where a VAR points to an object, and the object is freed because its not rooted in the GC. Ease of Attack: Simple, it is not known if any exploits exist for this.

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

Additional Links

Rule Vulnerability

CVE Additional Information

CVE-2018-8267
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8243.
Details
Severity Base Score7.5
Impact Score5.9 Exploit Score1.6
Confidentiality ImpactHIGH Integrity ImpactHIGH
Availability ImpactHIGH Access Vector
Authentication Ease of Access