Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
Enterprise I.T.
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Microsoft Releases
Microsoft Releases 'Fix It' for Zero-Day Vulnerability

By Jennifer LeClaire
February 21, 2014 12:49PM

Bookmark and Share
What Microsoft is offering with its Fix it for the Internet Explorer Zero-Day vulnerability is like placing a thimble under a roof leak -- you'll catch a few drips but ultimately it's ineffective over the long term. For the IE Zero-Day Fix it to be effective, Microsoft has to push it out to all users -- something it probably won't do with this workaround.
 



Redmond has issued a fix for the so-called watering hole attack. Microsoft confirmed reports last week of an active campaign attack affecting Internet Explorer 10 users.

Since then, it turns out IE 9 users are also at risk, but anyone using older versions are immune. The good news: Microsoft is pushing out a “Fix it” solution called "MSHTML Shim Workaround" it says prevents the exploitation of this issue.

“The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” Microsoft said in a security advisory.

“The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site.”

Social Engineering at Play

There are mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 runs in a restricted mode that is known as Enhanced Security Configuration by default. This mode mitigates this vulnerability. But the risks are real for many.

“An attacker who successfully exploited this vulnerability could gain the same user rights as the current user,” Microsoft said. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”

In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. Microsoft said compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability.

“In all cases, however, an attacker would have no way to force users to visit these Web sites,” the company explained. “Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.”

A Fix is Not a Patch

We caught up with Tyler Reguly, manager of security research for Tripwire, to get his take on the release. He told us it’s important to make the distinction here between a Fix it solution and a patch. (continued...)

1  |  2  |  Next Page >

 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Enterprise I.T.
1.   BlackBerry BES 10 Now Hosted
2.   Teaming Up: CIOs, IT Asset Managers
3.   Juniper DDoS for High-IQ Networks
4.   IBM Rolls Out Hybrid Cloud Services
5.   Windows 7 Ends Mainstream Support


advertisement
Backlash Stirs Against H-1B Visas
Debate over foreign workers continues.
Average Rating:
IBM Rolls Out Hybrid Cloud Services
Based on SoftLayer net infrastructure.
Average Rating:
Windows 7 Ends Mainstream Support
But extended support still available.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 
Dropbox for Business Beefs Up Security
Dropbox is upping its game for business users. The cloud-based storage and sharing company has rolled out new security, search and other features to boost its appeal for businesses.
 

Enterprise Hardware Spotlight
Microsoft Makes Design Central to Its Future
Over the last four years, Microsoft has doubled the number of designers it employs, putting a priority on fashioning devices that work around people's lives -- and that are attractive and cool.
 
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 

Mobile Technology Spotlight
Is the Amazon Fire Phone a Winner?
A late entry into a packed category of smartphones, Amazon's Fire phone offers a variety of unique features. Now, the reviewers are assessing if they're enough to make the phone stand out.
 
Review: Amazon Fire Offers New Ways To Use Phones
The Fire phone uses Android, but Amazon has modified it to the point that it's barely recognizable. That means the phone offers new ways to navigate, discover and, of course, shop.
 
Apple Patent for Smart Watch Comes to Light
Does a new smart watch patent issued to Apple provide a preview of the expected wearable from the tech giant? Some Apple-watchers are parsing the patent for signs of the coming product.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.