New, Unpatched IE 0 Day published at ZDI
The Zero Day Initiative has published a new and unpatched IE 0-Day that was originally reported to them (and by extension, Microsoft) in October 2013. In essence, a victim has to go to a crafted webpage that takes advantage of handling of CMarkup objects which ultimately can be used to execute code with the permissions of the web browser process. Microsoft says the EMET will mitigate this vulnerability and at least Tipping Point claims protection with their devices. At this point, there is no indication that it is being used in the wild. The interesting thing here is the timeline between initial report and there being no patch.
This diary will be updated as the situation warrants.
--
John Bambenek
bambenek \at\ gmail /dot/ com
Bambenek Consulting
Comments
Their reputation precedes them: I am afraid little has changed since the Windows 2000/IE5 days. Never heard of a Firefox or Chrome vulnerability that was reported and the vendor chose to leave unaddressed so long....
Anonymous
May 22nd 2014
1 decade ago
Anonymous
May 22nd 2014
1 decade ago
Also, I can't find enough technical information to home grow a signature to detect it. Does anybody have any detailed links?
Anonymous
May 22nd 2014
1 decade ago
Because for millions of lingering XP users, that would be tantamount to a recommendation to upgrade to a new version of Windows. IE8 is the last version available for Windows XP.
Mind you, getting off XP isn't itself a bad recommendation...
Anonymous
May 23rd 2014
1 decade ago