Intel

CVE-2016-0189

Microsoft Internet Explorer — Microsoft Internet Explorer Memory Corruption Vulnerability

criticalRansomwareKEV: actively exploitedPoCEPSS 94%

Description

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

Source: CISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-0189 carries a CISA "Known Ransomware Campaign Use" flag and sits at the 99.8th EPSS percentile, reflecting sustained real-world exploitation by exploit kits such as Neutrino and Magnitude that chain this vulnerability into full ransomware deployment. The primary risk profile is organisations still running IE 9–11 on legacy systems — a common scenario in KRITIS environments where industrial HMIs or internal web applications have not been migrated. Despite the vulnerability's age, unpatched IE instances remain reachable attack surfaces, and the low exploitation complexity (user visits a crafted page, no further interaction required) makes this a high-priority remediation item. Score it critical if any unpatched IE instance has internet access or sits on a network segment reachable from internet-facing systems; patch or isolate within 24 hours.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the patch: Deploy Microsoft security update MS16-051 (KB3154070) immediately to all Windows systems running Internet Explorer 9, 10, or 11 — this directly addresses the JScript 5.8 and VBScript 5.7/5.8 memory corruption flaw.
  • Disable Internet Explorer where not operationally required: Block iexplore.exe via AppLocker and redirect users to a patched alternative browser; enforce via GPO to prevent accidental re-launch.
  • Disable VBScript in the Internet Zone: Set Computer Configuration → Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Internet Zone → Allow VBScript to run in Internet Explorer to "Disabled" via GPO — effective even before the patch is deployed.
  • Enforce Enhanced Protected Mode (EPM): Enable EPM for IE 11 via GPO (Internet Explorer → Advanced → Enable Enhanced Protected Mode) to raise the cost of sandbox escape post-exploitation.
  • Restrict outbound web traffic: Route all workstation HTTP/HTTPS through a proxy with TLS inspection and URL categorisation to break drive-by download chains before they reach the scripting engine.
  • Invalidate privileged credentials on unpatched hosts: Revoke admin tokens and saved browser credentials on any system still running unpatched IE; enforce MFA for re-authentication.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place workstations in dedicated client VLANs with micro-segmentation rules (Windows Firewall GPO, VLAN ACLs) to limit lateral movement following a browser compromise.
  • Proxy/WAF rule: Configure the proxy to block or quarantine HTTP responses containing VBScript blocks (<script language="vbscript") in text/html or application/x-javascript content types.
  • Exploit Protection hardening: On Windows 10+, apply Set-ProcessMitigation -Name iexplore.exe -Enable DEP,SEHOP,ASLR; on legacy systems with EMET, enforce EAF+, forced ASLR, and DEP for iexplore.exe.
  • Least privilege: Ensure browser processes never run with local admin rights; set UAC to maximum; deploy LAPS for local accounts to limit credential reuse after compromise.
  • DNS sinkholing: Redirect known exploit-kit domains (sourced from threat-intelligence feeds) to an internal sinkhole IP to interrupt payload delivery before execution.
  • WDAC policy for scripting engines: Configure a Windows Defender Application Control policy to allow jscript.dll and vbscript.dll to load only from trusted, signed parent processes.

Runbook · Step 3

Detection rules

  • Sysmon EID 1 — Suspicious child processes of iexplore.exe: Process ancestry iexplore.exe → cmd.exe | powershell.exe | wscript.exe | mshta.exe is a strong exploitation indicator. Sigma shape: ParentImage|endswith: 'iexplore.exe' AND Image|endswith: '\cmd.exe' (or \powershell.exe).
  • Windows Event ID 4688 (process creation with command line): Alert on any child process of iexplore.exe that initiates network connections or spawns rundll32.exe with unusual arguments.
  • Sysmon EID 3 (network connection): Outbound connections from iexplore.exe directly to bare IP addresses (no FQDN) on ports 80/443 — exploit kits frequently use numeric IPs for payload staging.
  • Sysmon EID 7 (image load): Loading of jscript.dll or vbscript.dll from paths outside %SystemRoot%\System32 by iexplore.exe or mshta.exe.
  • Proxy log pattern (SPL): index=proxy dest_category=unknown http_method=GET uri_path="*.php?id=*" | where bytes_out > 50000 — matches typical exploit-kit landing page responses with large body sizes used to deliver shellcode.

Metrics

Severity
critical
Priority score
160.78
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
94.1 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-03-28 00:00 UTC
CWE
—

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-0189