Vulnerability in Internet Explorer Could Allow Remote Code Execution

https://technet.microsoft.com/en-US/library/security/2963983

by lelf • 12 years ago

43 15 12 years ago

technet.microsoft.com

mkempe• 12 years ago

The subtitle has the meat: "Vulnerability in Internet Explorer Could Allow Remote Code Execution".

"Microsoft is aware of limited, targeted attacks that attempt to exploit a vulnerability in [IE 6 through 11]." --date published: April 26, 2014.

easy_rider• 12 years ago

I think remote code execution and the easy method for payload delivery warrants a high level of concern.

rainforest• 12 years ago

It seems from the subtitle that this isn't just a known vulnerability, but one being exploited in the wild, if I'm not mistaken. Definitely a serious concern either way though.

ld00d• 12 years ago

XP is absent from the list of affected OSes. Does that mean XP isn't affected, or is it just off the radar now that it's no longer supported.

Could this be the first big unpatched XP hole?

0x0• 12 years ago

Isn't there an extended, for-pay support service for xp? In that case, it must mean a patch will be engineered and released to paying customers. How long until these leak out and pirates start trading XP patches?

TheLoneWolfling• 12 years ago

How long until people start offering unofficial patches that include backdoors?

yuhong• 12 years ago

I think XP is affected. Luckily the current exploits only works on IE9-11, excluding XP.

matthewmacleod• 12 years ago

Microsoft is aware of limited, targeted attacks that attempt to exploit a vulnerability in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.

I'm pretty sure this will affect XP as a result.

eps2• 12 years ago

Mitigated by EMET.

If you are on Windows and you are not running EMET, you should really drop everything right now and install it.

http://www.microsoft.com/emet

bananas2• 12 years ago

No you shouldn't.

1. It breaks a lot of stuff.

2. It isn't very good:

http://bromiumlabs.files.wordpress.com/2014/02/bypassing-eme...

At best it's a dose of Tamiflu.

As many people before have said, you can't retrospectively apply security mitigations properly; you have to design them in from the start.

Spittie• 12 years ago

1. Really? I've been using it for a while, and no breakage. Sure, I just use the default rulelist instead of applying rules to everything (which imo is what most people should do).

2. Sure, but it's better than nothing. As parent said, this exploit is mitigated by EMET. See http://rationallyparanoid.com/articles/emet-testing.html for more tests

Yes, it's a bandaid. But since it help and it's free, why not?

eps2• 12 years ago

Who said to apply EMET to "a lot of stuff"?

It is meant to plug holes in apps that handle untrusted data. For a vast majority of people that would be a browser, a mail client and various document viewers. IE, Firefox, Chrome, Flash player, Outlook, Thunderbird and Acrobat Reader all run A-Ok under EMET and most of them are on its default list.

Remeber the RTF zeroday from a couple weeks ago? It too was mitigated with EMET. That's two zerodays in two weeks.

The Bromium labs bypass was addressed in EMET 5.0, not few weeks after their announcement.

The bottom line is that it the most effective zeroday protection available at the moment. Is it perfect? No. Does it work? Yes.

lawnchair_larry• 12 years ago

Terrible advice. You should definitely run EMET.

Vulnerability in Internet Explorer Could Allow Remote Code Execution

Related Stories