IE Zero Day Advisory from Microsoft
Microsoft released a Security Advisory yesterday(1) which impacts Internet Explorer versions 6 through 11, taking advantage of a vulnerability in Flash. The Microsoft advisory notes that â??The vulnerability is a remote code execution vulnerability. â?¦ The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.â?ť
This exploit is currently being seen in limited attacks at this time against versions IE9-IE11, according to the security vendor Fireeye(2), who is working with MS at this time. At the time of this writing, a patch is not yet available.
Actions to take to limit the impact of the vulnerability:
- Install EMET . According to Fireeye's testing, EMET 4.1 and 5 do break the exploit.
- Disable Flash . Note that IE 10 and later on Windows 8 do include Flash. But you can still disable it. This is an IE vulnerability but Flash is needed to exploit it and bypass some of the protection techniques implemented in newer versions of IE/Windows.
- Enable the Internet Explorer "Enhanced Protection Mode" (EPM) which became available in Internet Explorer 10. But it may break some plugins.
Â
(1)https://technet.microsoft.com/en-US/library/security/2963983
tony d0t carothers --gmail
Comments
Anonymous
Apr 28th 2014
1 decade ago
Is this the first official non-patch event for XP?
Anonymous
Apr 28th 2014
1 decade ago
http://social.technet.microsoft.com/wiki/contents/articles/11406.how-to-disable-internet-explorer-ie-add-ons-through-group-policy.aspx
Anonymous
Apr 28th 2014
1 decade ago
Anonymous
Apr 28th 2014
1 decade ago
Looks like that Adobe Flash update is to address a different CVE (CVE-2014-0515).
Anonymous
Apr 28th 2014
1 decade ago
Anonymous
Apr 28th 2014
1 decade ago
Anonymous
Apr 28th 2014
1 decade ago
INCORRECT:
===============
K-Dee, yes the 13.0.0.206 update is explicitly about this vulnerability. See:
http://helpx.adobe.com/security/products/flash-player/apsb14-13.html
"Adobe is aware of reports that an exploit for CVE-2014-0515 exists in the wild, and is being used to target Flash Player users on the Windows platform."
===============
Anonymous
Apr 28th 2014
1 decade ago
Mike: I would say yes, this is the first "XP" issue that will go unpatched (unless you paid).
Anonymous
Apr 28th 2014
1 decade ago
Anonymous
Apr 28th 2014
1 decade ago