Risk
1/7/2013
09:24 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Microsoft Patches Won't Fix IE Zero-Day Vulnerability

Microsoft's first Patch Tuesday of 2013 will address 12 flaws, including a critical vulnerability affecting virtually all Windows machines.

CES 2013: 9 Cool Gadgets
CES 2013: 9 Cool Gadgets
(click image for larger view and for slideshow)
For many tech professionals, Tuesday will be all about the Consumer Electronics Show (CES) spectacle. For IT admins, though, the day is likely to be spent deploying Microsoft's first security patches of 2013. The collection of seven patches will address 12 problems, two of which have been classified as critical vulnerabilities. It won't, however, offer a permanent solution for an Internet Explorer (IE) vulnerability discovered in late December.

Both of the critical vulnerabilities Microsoft will patch allow attackers to remotely execute code on unpatched machines. One affects only Windows 7 and Windows Server 2008 R2 -- but the confined risk doesn't mitigate the potential damage, given that Windows 7 is the world's most widely deployed OS. The other involves virtually all Windows variations currently used in the enterprise: Windows XP through Windows 8, as well as Windows Server 2003, 2008, 2008 R2 and 2012. Instituting the patches could cause admins a few minor headaches; all but one of the seven patches, including the two most urgent ones, require that machines be restarted.

The presently unpatched zero-day vulnerability in IE, meanwhile, was first described by cybersecurity firm FireEye, which published a blog post on December 28, one day after receiving reports that the website for the Council on Foreign Relations had been compromised. FireEye said the site had been injected with malicious code due to an error in IE 8. The firm declined to provide in-depth technical details until Microsoft issues a solution, but it noted that the JavaScript involved includes a few peculiarities, such as exploiting only browsers whose OS language is English, Chinese, Japanese, Korean or Russian.

Microsoft acknowledged the problem a day later and revealed that IE 6, 7 and 8 are affected. The company explained that an attacker "could take complete control of an affected system" and has offered a workaround until a complete patch is released.

[ Microsoft had a tough year in 2012, with disappointing sales for long-awaited products including Windows 8 and the Surface tablet. Learn 6 Things Microsoft Must Do In 2013. ]

Given how recently the exploit was discovered, it would have been surprising if Microsoft had bundled a patch into the forthcoming updates. The fact the IE 9 and 10 are not vulnerable takes a bit of the urgency off, but security firm Exodus Intelligence claims that the current workaround is easily subverted. The company provided technical details of the bypass to its customers, but will not make the information public until Microsoft has issued a patch.

In an earlier analysis, Exodus Intelligence co-founder Peter Vreugdenhil wrote that the vulnerability is "just another Internet Explorer use-after-free bug which was actually relatively easy to analyze and exploit." A Sophos Security blog post, meanwhile, took a more somewhat more aggressive tone in describing the risk, tracing the exploit to a handful of additional attacks and recommending that users avoid affected versions of IE.

In an email, IDC analyst Al Hilwa wrote that, "Releasing information about a vulnerability before it is patched is always a balancing act." If Microsoft learned that the exploit had become known within the hacker community, he asserted, the knowledge would compelled the the company's leaders to "exposite it and give recommendations even prior to figuring out a solution."

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
johnitguru
50%
50%
johnitguru,
User Rank: Apprentice
1/7/2013 | 6:22:35 PM
re: Microsoft Patches Won't Fix IE Zero-Day Vulnerability
I got tired of Microsoft viruses, scams and malware so I installed a really cool 3D Linux operating system for only $39.95 that is 100% compatible with all my Windows data and is 10 times faster called Robolinux.

It took me only 5 minutes to install it.

Now I can surf the web until I am blue in the face and I can't get a virus.

Check it out go to robolinux.org

http://robolinux.org
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

CVE-2014-5212
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.