CVE-2020-0674: 
vulnerability analysis and mitigation

CVE-2020-0674 is a remote code execution vulnerability that exists in the way the scripting engine handles objects in memory in Internet Explorer, specifically affecting versions 8 through 11. The vulnerability was discovered by Clément Lecigne of Google's Threat Analysis Group and Ella Yu from Qihoo 360, with Microsoft acknowledging limited targeted attacks in the wild (MITRE, Trustwave).

The vulnerability is classified as a Use-After-Free (UAF) issue in the legacy JScript engine, specifically occurring in the Array sort function when using a comparator function. The two supplied arguments for the comparator function are not tracked by the Garbage Collector, causing them to point to freed memory after the GC is called. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD, GitHub).

If successfully exploited, the vulnerability allows attackers to execute arbitrary code in the context of the current user. When users are logged on with administrative user rights, an attacker could take control of an affected system, including installing programs, viewing or modifying data, or creating new accounts with full user rights (MITRE).

Microsoft released security updates to address this vulnerability. Prior to the patch, temporary mitigation involved restricting access to the JScript.dll file. However, this workaround could result in reduced functionality for components or features that rely on jscript.dll. For Trustwave's Secure Web Gateway (SWG) customers, protection against attacks exploiting this CVE was included in Security Update 222 released in January 2019 (Trustwave).

The vulnerability gained significant attention as it followed shortly after Microsoft's first Patch Tuesday of 2020, which addressed a critical vulnerability in CryptoAPI. Security researchers and professionals emphasized the severity of the vulnerability, particularly due to its active exploitation in the wild (Trustwave).