Internet Explorer 8 ASLR Bypass

Successful exploitation allows an attacker to defeat ASLR protections in Internet Explorer 8, reducing the effectiveness of memory-randomization defenses. By itself, this does not directly provide arbitrary code execution, but it can significantly increase the reliability of a separate memory-corruption exploit by making memory layout more predictable. In practical attack chains, this can facilitate remote code execution in the context of the current user when combined with another exploitable vulnerability.

Limit exposure by reducing or preventing use of the affected Internet Explorer version, especially for browsing untrusted content. Use least-privilege accounts so that any chained post-exploitation impact is reduced. On Windows Server systems, Internet Explorer Enhanced Security Configuration reduces exposure to specially crafted web content. General mitigations include restricting access to attacker-controlled or untrusted websites and advertisements until the security update is applied.

Apply Microsoft's Security Update 3034682 for the affected Internet Explorer version and platform. The bulletin states that the update improves Internet Explorer's implementation of ASLR to address security feature bypass issues. Where applicable to Internet Explorer 9, 10, and 11, Microsoft required installation of both updates 3021952 and 3034196 for full protection, but the provided content specifically identifies CVE-2015-0051 as affecting Internet Explorer 8.