Microsoft Releases ‘Fix It’ for Zero-Day Vulnerability

Redmond has issued a fix for the so-called watering hole attack. Microsoft confirmed reports last week of an active campaign attack affecting Internet Explorer 10 users.

Since then, it turns out IE 9 users are also at risk, but anyone using older versions are immune. The good news: Microsoft is pushing out a EUFix itEU solution called "MSHTML Shim Workaround" it says prevents the exploitation of this issue.

EUThe vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,EU Microsoft said in a security advisory.

EUThe vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site.EU

Social Engineering at Play

There are mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 runs in a restricted mode that is known as Enhanced Security Configuration by default. This mode mitigates this vulnerability. But the risks are real for many.

EUAn attacker who successfully exploited this vulnerability could gain the same user rights as the current user,EU Microsoft said. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.EU

In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. Microsoft said compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted...

Comments are closed.