HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 8 MINUTES AGO.
You are here: Home / Apple/Mac / Microsoft Rushes Fix for IE Bug
Build Apps 5x Faster
For Half the Cost Enterprise Cloud Computing
On Force.com
Microsoft Pushes Workaround for IE Emergency
Microsoft Pushes Workaround for IE Emergency
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
SEPTEMBER
18
2013

Software giant Microsoft just woke up from a bad dream. Redmond is facing a zero-day vulnerability in all versions of its Internet Explorer browser and has rushed an urgent fix for the bug.

Microsoft is officially investigating public reports of the vulnerability and admits it is aware of targeted attacks that attempt to exploit the zero-day flaw in Internet Explorer 8 and Internet Explorer 9. Redmond was fast on its feet to release a workaround known as the "CVE-2013-3893 MSHTML Shim Workaround," to prevent hackers from exploiting the software.

The company said it is dealing with a remote code execution vulnerability. It seems there's a flaw in the way IE accesses an object in memory that has been deleted or hasn't been properly allocated.

"The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer," Microsoft said in a security advisory. "An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site."

Good News, Bad News

We caught up with Paul Henry, a security and forensic analyst at Lumension, to get his thoughts on the workaround. He told us there's good news and bad news here. The good news is there are many mitigating factors. The bad news is this is a very wide-reaching workaround, affecting all versions of IE across all operating systems, from XP to RT.

"And more bad news: the average user is very susceptible to being hit with this. The average user does not run the restricted sites mode, is not using the Enhanced Security Configuration, and [may be] all too willing to click on phishing emails," Henry said.

"I recommend employing the mitigating factors, as well as advising users about this so they will be less likely to click malicious links until you can apply the [workaround]," he said.

The Mitigating Factors

In its security advisory, Microsoft listed four mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 run in a restricted mode that is known as Enhanced Security Configuration by default.

Also by default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the restricted sites zone. According to the company, the restricted sites zone, which disables script and ActiveX controls, helps reduce the risk that an attacker can use this vulnerability to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of this vulnerability through the web-based attack scenario.

Microsoft said an attacker who successfully exploits this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

"In a web-based attack scenario, an attacker could host a Web site that contains a webpage that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability," Microsoft said.

"In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's Web site."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
ISACA® offers a global community of more than 115,000 IS/IT constituents in over 180 countries. We develop and deliver industry-leading certifications, education, research and business frameworks. We equip individuals to be leaders in the fast-changing world of information systems and IT - Learn More>
MORE IN APPLE/MAC
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
An easily avoided security lapse -- failure to use two-factor authentication on a single server -- is being blamed for the massive computer breach that hit JPMorgan Chase this past summer.

ENTERPRISE HARDWARE SPOTLIGHT
Flying under the radar just before Christmas, HP has launched a new version of its Chromebook 14, most notable for its touch screen and full high-definition display, plus more powerful specs.
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.