Project Hyphae

Internet Explorer Returns From The Dead With Fresh Exploits

zombIE
Will the undead zomb-IE ever die?

Share This Post

Microsoft ended support for Internet Explorer on June 15, 2022. However, IE’s deep integration into the Windows operating system means that each Windows host still has an IE-specific Event Log. This Event Log and its distinct set of permissions have ramifications that are being felt to this day, specifically via two exploits targeting Windows systems that were recently discovered by Varonis: LogCrusher and Overlog.

LogCrusher can allow any domain user to remotely crash the Event Log application of any Windows machine on the current domain. This could be particularly useful for a malicious actor as a way to cover their tracks before performing an attack on a system. OverLog can cause a remote denial-of-service (DoS) attack by inflating this Event Log file, to the point of entirely filling up the hard drive space of any Windows machine on the current domain.

A partial patch was released on October 11, 2022 to address this. However, Microsoft has also opted not to fully fix the LogCrusher vulnerability on Windows 10.

Windows 11 and Windows Server 2022 are unaffected.

To read the entire breakdown of both exploits, visit Varonis’ site for their full report: https://www.varonis.com/blog/the-logging-dead-two-windows-event-log-vulnerabilities

More To Explore

Information Security News 11-28-2022

Know Thy Enemy: Thinking Like a Hacker can Boost Cybersecurity Strategy Article Link: https://www.csoonline.com/article/3680371/know-thy-enemy-thinking-like-a-hacker-can-boost-cybersecurity-strategy.html 90% of Organizations Have Microsoft 365 Security Gaps Article Link: https://www.helpnetsecurity.com/2022/11/22/microsoft-365-security-protections/

Information Security News 11-21-2022

Transportation Sector Targeted by Both Ransomware and APTs Article Link: https://www.helpnetsecurity.com/2022/11/18/cybersecurity-trends-q3-2022/ Misconfigurations, Vulnerabilities Found in 95% of Applications Article Link: https://www.darkreading.com/application-security/misconfigurations-vulnerabilities-found-in-95-of-applications Electronics Repair Technicians Snoop

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.