Software giant Microsoft just woke up from a bad dream. Redmond is facing a zero-day vulnerability in all versions of its Internet Explorer browser and has rushed an urgent fix for the bug.
Microsoft is officially investigating public reports of the vulnerability and admits it is aware of targeted attacks that attempt to exploit the zero-day flaw in Internet Explorer 8 and Internet Explorer 9. Redmond was fast on its feet to release a workaround known as the "CVE-2013-3893 MSHTML Shim Workaround," to prevent hackers from exploiting the software.
The company said it is dealing with a remote code execution vulnerability. It seems there's a flaw in the way IE accesses an object in memory that has been deleted or hasn't been properly allocated.
"The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer," Microsoft said in a security advisory. "An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site."
Good News, Bad News
We caught up with Paul Henry, a security and forensic analyst at Lumension, to get his thoughts on the workaround. He told us there's good news and bad news here. The good news is there are many mitigating factors. The bad news is this is a very wide-reaching workaround, affecting all versions of IE across all operating systems, from XP to RT.
"And more bad news: the average user is very susceptible to being hit with this. The average user does not run the restricted sites mode, is not using the Enhanced Security Configuration, and [may be] all too willing to click on phishing emails," Henry said.
"I recommend employing the mitigating factors, as well as advising users about this so they will be less likely to click malicious links until you can apply the [workaround]," he said.
The Mitigating Factors
In its security advisory, Microsoft listed four mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 run in a restricted mode that is known as Enhanced Security Configuration by default.
Also by default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the restricted sites zone. According to the company, the restricted sites zone, which disables script and ActiveX controls, helps reduce the risk that an attacker can use this vulnerability to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of this vulnerability through the web-based attack scenario.
Microsoft said an attacker who successfully exploits this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
"In a web-based attack scenario, an attacker could host a Web site that contains a webpage that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability," Microsoft said.
"In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's Web site."