Redmond has issued a fix for the so-called watering hole attack. Microsoft confirmed reports last week of an active campaign attack affecting Internet Explorer 10 users.
Since then, it turns out IE 9 users are also at risk, but anyone using older versions are immune. The good news: Microsoft is pushing out a “Fix it” solution called "MSHTML Shim Workaround" it says prevents the exploitation of this issue.
“The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” Microsoft said in a advisory.
“The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site.”
Social Engineering at Play
There are mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 runs in a restricted mode that is known as Enhanced Security Configuration by default. This mode mitigates this vulnerability. But the risks are real for many.
“An attacker who successfully exploited this vulnerability could gain the same user rights as the current user,” Microsoft said. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”
In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. Microsoft said compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability.
“In all cases, however, an attacker would have no way to force users to visit these Web sites,” the company explained. “Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.”
A Fix is Not a Patch
We caught up with Tyler Reguly, manager of security research for Tripwire, to get his take on the release. He told us it’s important to make the distinction here between a Fix it solution and a patch.
“This is not a patch. It is a workaround that you can download from the Microsoft Web site,” Reguly said. “The average enterprise or individual is unlikely to deploy this Fix it. They are great options for the security minded but the average Joe is still going to be vulnerable.”
Reguly compared it to a leaky roof. What Microsoft is offering up, he said, is the equivalent of placing a thimble under the leak. In other words, you'll catch a few drips but ultimately it's ineffective over the long term.
“In order for Fix it solutions to truly be effective, Microsoft needs to have a way to push them out to all users and I don't see them doing that with a workaround. There are too many potential compatibility issues and workarounds don't generally see the same rigorous testing that patches do,” Reguly said.
“It'd be interesting to statistics regarding how many people view the Fix it page versus those that download the Fix it versus those that apply the Fix it. I wonder if Microsoft has any of those numbers and would be interested in releasing them," he added.