Vulnerabilities / Threats
9/18/2013
09:41 AM
50%
50%

Microsoft: Beware IE Zero-Day Attacks

Microsoft offers temporary fix for security flaw in most versions of Internet Explorer, but doesn't yet have a patch to stop attackers from remotely executing code.

20 Great Ideas To Steal In 2013
20 Great Ideas To Steal In 2013
(click image for larger view)
Internet Explorer users, watch where you browse.

Microsoft issued that warning Tuesday after spotting some in-the-wild attacks targeting a new bug in IE. "There are only reports of a limited number of targeted attacks specifically directed at Internet Explorer 8 and 9, although the issue could potentially affect all supported versions" -- meaning also Internet Explorer versions 6, 7, 10 and 11 -- said Dustin Childs, a group manager for communications in Microsoft's Trustworthy Computing group, in a blog post.

"We are actively working to develop a security update to address this issue," Childs said, though he provided no timeline for when that might happen.

[ Could crowdsourcing help in instances like this? Read HP Portal Crowdsources Security Threat Intelligence. ]

According to Microsoft security engineer Neil Sikka, the IE bug (CVE-2013-3893) that attackers have been exploiting enables them to bypass the address space layout randomization (ASLR) attack-blocking feature built into newer versions of IE, and gain the ability to remotely execute code. "The exploit was attacking a 'use after free' vulnerability in IE's HTML rendering engine (mshtml.dll) and was implemented entirely in JavaScript -- no dependencies on Java, Flash etc. -- but did depend on a Microsoft Office DLL, which was not compiled with ASLR enabled," Sikka said in a blog post.

Microsoft's related security advisory said the most likely mode of exploitation would be for attackers to host malicious websites or else submit "specially crafted content that could exploit this vulnerability" to third-party- sites that accept "user-provided content or advertisements." Accordingly, Microsoft said to beware of any links of unknown origin that might arrive via email, instant messaging or social networks, since they might lead to a site designed to exploit the vulnerability.

Related attacks, if successful, would give attackers' code "the same user rights as the current user," meaning they might be able to "install programs; view, change, or delete data; or create new accounts with full user rights." Accordingly, attackers might be able to do less damage against non-administrator or relatively locked-down user accounts.

Not all types of IE are at risk from exploits of this bug. According to Microsoft's security advisory, by default, Internet Explorer on Windows Server 2003, 2008, 2008 R2, 2012, and 2012 R2 runs in a restricted mode, known as "enhanced security configuration," which mitigates the vulnerability. Likewise, by default all "supported" versions of Microsoft Outlook, Microsoft Outlook Express and Windows Mail open any received HTML in a restricted zone, which would also mitigate the vulnerability.

How can businesses protect themselves? Microsoft has released a temporary "fix it" solution for 32-bit versions of Internet Explorer that it's calling the MSHTML Shim Workaround. "This Fix it solution is not intended to be a replacement for any security update. We recommend that you always install the latest security updates," according to Microsoft's security advisory. "However, we offer this Fix it solution as a workaround option for some scenarios," such as the current one, in which Microsoft has yet to patch the flaw that's being exploited. For this workaround to work, however, a PC must first have installed a cumulative security update for IE released on Sept. 10 by Microsoft.

Microsoft's Sikka said that the company's Enhanced Mitigation Experience Toolkit (EMET) -- version 3.0 or 4.0 -- can also be used to help prevent related exploits from being successful. This approach, notably, will work not only with 32-bit but also 64-bit versions of IE.

Tuesday's Fix It release was the first time in four months that Microsoft has had to release an emergency workaround for a flaw that's being actively exploited by attackers, said Chester Wisniewski, a senior security advisor at Sophos Canada, in a blog post.

But are the EMET or Fix It mitigation strategies worth the effort? For business users, the answer is yes, said Wisniewski. But consumers might spare themselves the hassle, and instead adopt a simpler -- perhaps temporary, perhaps not -- fix. "My advice for non-corporate PCs is to simply use another browser until Microsoft is able to deliver a fix," he said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/19/2013 | 3:17:00 PM
re: Microsoft: Beware IE Zero-Day Attacks
Unfortunately, updating Office won't help. The bug exists in an Office DLL that's in IE. Ironically, Microsoft in 2011 issued a report warning that only 20% of tested products -- including Microsoft software -- fully implemented ASLR. If Microsoft had followed its own advice, related attacks against this bug wouldn't have been possible.

Instead, Websense -- which studied real-world IE usage patterns -- said Wednesday that up to 70% of enterprise users are now at risk of being exploited by attacks that target this vulnerability.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
9/18/2013 | 4:29:53 PM
re: Microsoft: Beware IE Zero-Day Attacks
If the flaw was in an Office module, why aren't they telling people to update Office as well?
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.