The still-active Zero-Day Exploit threatens the frequently vulnerable JavaScript Engine
Customers of Menlo Security using Internet Explorer (IE) are protected against a recent and still-active zero-day exploit using Internet Explorer, as outlined by Microsoft’s security update CVE-2020-1380.
The remote code execution vulnerability allows an attacker to take advantage of how the engine handles memory and to force corruption.
From the Microsoft Security website:
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. (…). The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
If the attack is successful, the bad actor could install malware, exfiltrate data, or bring down an entire network.
Safe with Internet Isolation
For the 46 percent of users on the Menlo Security Isolation Platform who are using IE11, you are protected from this exploit.
As participants in the Microsoft Active Protections Program (MAPP), Menlo was able to access additional details about the vulnerability and confirm the JavaScript engine flaw. That information helped us to understand the details of the threat and confirm that our users are protected.
In this real-world scenario, the attacker will be unable to compromise the end-user’s device because our Isolation Core™ executes active content in our cloud and allows only safe visuals to be sent to the end-user.
Any active threat exists in the cloud, away from the device, resulting in complete safety for users with this vulnerable version of IE.
To learn more about how Menlo Security protects you from zero-day threats, read our Internet Isolation datasheet.
