Project Hyphae

Internet Explorer Returns From The Dead With Fresh Exploits

Will the undead zomb-IE ever die?

Share This Post

Microsoft ended support for Internet Explorer on June 15, 2022. However, IE’s deep integration into the Windows operating system means that each Windows host still has an IE-specific Event Log. This Event Log and its distinct set of permissions have ramifications that are being felt to this day, specifically via two exploits targeting Windows systems that were recently discovered by Varonis: LogCrusher and Overlog.

LogCrusher can allow any domain user to remotely crash the Event Log application of any Windows machine on the current domain. This could be particularly useful for a malicious actor as a way to cover their tracks before performing an attack on a system. OverLog can cause a remote denial-of-service (DoS) attack by inflating this Event Log file, to the point of entirely filling up the hard drive space of any Windows machine on the current domain.

A partial patch was released on October 11, 2022 to address this. However, Microsoft has also opted not to fully fix the LogCrusher vulnerability on Windows 10.

Windows 11 and Windows Server 2022 are unaffected.

To read the entire breakdown of both exploits, visit Varonis’ site for their full report:

Reach out to our incident response team for help

More To Explore

Information Security News 9-18-2023

Iranian Cyberspies Target Thousands of Organizations with Password Spray Attacks Article Link: Requests via Facebook Messenger Lead to Hijacked Business Accounts Article Link:

Information Security News 9-11-2023

University of Michigan Requires Password Resets After Cyberattack Article Link: Attackers Accessed UK Military Data Through High-Security Fencing Firm’s Windows 7 Rig Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.