IE Zero Day Advisory from Microsoft

Published: 2014-04-27
Last Updated: 2014-04-28 00:06:08 UTC
by Tony Carothers (Version: 1)
20 comment(s)

Microsoft released a Security Advisory yesterday(1) which impacts Internet Explorer versions 6 through 11, taking advantage of a vulnerability in Flash.  The Microsoft advisory notes  that â??The vulnerability is a remote code execution vulnerability. â?¦ The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.â?ť 

This exploit is currently being seen in limited attacks at this time against versions IE9-IE11, according to the security vendor Fireeye(2), who is working with MS at this time.  At the time of this writing, a patch is not yet available.

Actions to take to limit the impact of the vulnerability:

- Install EMET . According to Fireeye's testing, EMET 4.1 and 5 do break the exploit.

- Disable Flash . Note that IE 10 and later on Windows 8 do include Flash. But you can still disable it. This is an IE vulnerability but Flash is needed to exploit it and bypass some of the protection techniques implemented in newer versions of IE/Windows.

- Enable the Internet Explorer "Enhanced Protection Mode" (EPM) which became available in Internet Explorer 10. But it may break some plugins.

 

(1)https://technet.microsoft.com/en-US/library/security/2963983

(2)http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html


tony d0t carothers --gmail

Keywords:
20 comment(s)

Comments

It should be noted that the Enhanced Protection Mode is under the Advanced Tab (the last tab) in settings lower down under security, as there is something similarly named that is on by default in the first tab...
Microsoft states that Windows Server 2003 is affected, but doesn't mention Windows XP at all, even though it's almost certainly affected too.

Is this the first official non-patch event for XP?
Another possibility for mitigating this in Domain environments would be to disable Flash via Group Policy. Details here -
http://social.technet.microsoft.com/wiki/contents/articles/11406.how-to-disable-internet-explorer-ie-add-ons-through-group-policy.aspx
Does the new flash player v13.0.0.206 that came out very recently address this at all?
Doesn't look like it: https://helpx.adobe.com/security/products/flash-player/apsb14-13.html

Looks like that Adobe Flash update is to address a different CVE (CVE-2014-0515).
With EMET 4.1 installed launching IE causes Sophos Anti-Virus to quarantine IE due to a Buffer Overflow. I guess stopping IE from starting is one way to secure it.
I've read that this is explicitly NOT covered by EMET 3.0, how about EMET 4.0? Can anyone confirm?
CORRECTION: This is what happens when I don't check all the details. As Anonymous commented re the Sophos article, the Adobe fix referred to a different CVE number (CVE-2014-0515) than the MS 0-day CVE (CVE-2014-1776). I mistook the references in the Adobe announcement to refer to the MS 0-day when in fact the actual CVE was entirely different. Mea culpa :(


INCORRECT:
===============
K-Dee, yes the 13.0.0.206 update is explicitly about this vulnerability. See:

http://helpx.adobe.com/security/products/flash-player/apsb14-13.html

"Adobe is aware of reports that an exploit for CVE-2014-0515 exists in the wild, and is being used to target Flash Player users on the Windows platform."
===============
The MS blog only mentions EMET 4.1 and EMET 5.0, so I would assume anything earlier doesn't protect you.

Mike: I would say yes, this is the first "XP" issue that will go unpatched (unless you paid).
BTW, this is the MS blog I was referring to hxxp://blogs.technet.com/b/srd/archive/2014/04/26/more-details-about-security-advisory-2963983-ie-0day.aspx

Diary Archives