CVE-2013-2551 in microsoft internet explorer
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
Affected software: microsoft internet explorer
Scores
- CVSS: 8.8 (high)
- EPSS: 74.10% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-28, used in ransomware
- Published: 2013-03-11
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install MS13-037 (KB2829530) or remove Internet Explorer 6-10
Patch or upgrade. Microsoft's cumulative Internet Explorer update MS13-037 (KB2829530) fixes the use-after-free that lets a crafted web site run code in Internet Explorer 6 to 10. All of these IE versions and their Windows releases are long out of support, so the real fix is to retire them.
Applies to: Internet Explorer 6, 7, 8, 9 and 10 on Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows Server 2012 and Windows RT without KB2829530. Server Core installations are not affected.
- Inventory Windows hosts that still run Internet Explorer 6, 7, 8, 9 or 10 (Windows XP, Vista, 7, 8, Server 2003/2008/2008 R2/2012).
- On each such host, install security update KB2829530 (MS13-037) or any later cumulative Internet Explorer update via Windows Update, WSUS or your patch management tool.
- Reboot the host when the update asks for it.
- Where possible, upgrade to a supported Windows release and move users to Microsoft Edge, and disable Internet Explorer (Windows Features, or the 'Disable Internet Explorer 11 as a standalone browser' group policy).
- For hosts that cannot be upgraded (legacy systems), block their web browsing to the internet at the proxy or firewall and isolate them on a separate network segment.
- Confirm with your vulnerability scanner that CVE-2013-2551 / MS13-037 is no longer reported.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.