HOME     MENU     SEARCH     NEWSLETTER    
CUSTOMER RELATIONSHIP MANAGEMENT NEWS. UPDATED 6 MINUTES AGO.
You are here: Home / Microsoft/Windows / Microsoft Issues Fix It for IE Zero Day
Neustar, Inc.
Protect your website & network using real-time information & analysis
www.neustar.biz
Microsoft Releases 'Fix It' for Zero-Day Vulnerability
Microsoft Releases 'Fix It' for Zero-Day Vulnerability
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
FEBRUARY
21
2014


Redmond has issued a fix for the so-called watering hole attack. Microsoft confirmed reports last week of an active campaign attack affecting Internet Explorer 10 users.

Since then, it turns out IE 9 users are also at risk, but anyone using older versions are immune. The good news: Microsoft is pushing out a “Fix it” solution called "MSHTML Shim Workaround" it says prevents the exploitation of this issue.

“The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” Microsoft said in a security advisory.

“The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site.”

Social Engineering at Play

There are mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 runs in a restricted mode that is known as Enhanced Security Configuration by default. This mode mitigates this vulnerability. But the risks are real for many.

“An attacker who successfully exploited this vulnerability could gain the same user rights as the current user,” Microsoft said. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”

In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. Microsoft said compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability.

“In all cases, however, an attacker would have no way to force users to visit these Web sites,” the company explained. “Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.”

A Fix is Not a Patch

We caught up with Tyler Reguly, manager of security research for Tripwire, to get his take on the release. He told us it’s important to make the distinction here between a Fix it solution and a patch. (continued...)

1  |  2  |  Next Page >

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Protect 100% of your Data The prevalence of laptops and mobile devices in the enterprise makes corporate data increasingly vulnerable to loss and breach. And yet, workforce productivity is now inextricably linked to mobility. Click here to access the white paper "Top 10 Endpoint Backup Mistakes" to learn more about how to confidently protect data across platforms and devices while also providing features designed to enhance the end user experience.
MORE IN MICROSOFT/WINDOWS

NETWORK SECURITY SPOTLIGHT
If you're a Google Gmail user, it's bad news. About 5 million Gmail addresses and plain text passwords were leaked to an online forum on Tuesday. The good news: the data is old, but better security is still needed.

ENTERPRISE HARDWARE SPOTLIGHT
The tech giant is expanding its cloud solutions which promise secure access to enterprise phone, email, and storage apps. The latest addition to the Dell Mobile Workspace involves Vonage and MS Office 365.

MOBILE TECHNOLOGY SPOTLIGHT
The world's highest-capacity SD card is being offered by SanDisk, 512 gigabytes of flash storage aimed at professionals shooting 4K Ultra HD video or high-speed burst mode photography. Price: $800.

Product Information and Resources for Technology You Can Use To Boost Your Business

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.