Microsoft Issues 'fix it' To Close Internet Explorer 0-day Vulnerability
Last few days the whole cyber world have gone through with so many drama of Internet Explorer's security bug, as researchers have unveiled four active exploits of a zero-day vulnerability in the browser. As expected the software giant Microsoft has released an emergency fix to get rid of these major security issues. Microsoft released a “fix it” tool for a critical security flaw in most versions of Internet Explorer 6, 7, 8 and 9 that hackers have been exploiting to break into Windows systems. The company said it expects to issue an official patch (MS12-063) for the vulnerability on Friday, Sept. 21. "While we have only seen a few attempts to exploit this issue, impacting
an extremely limited number of people, we are taking this proactive
step to help ensure Internet Explorer customers are protected and able
to safely browse online," said Yunsun Wee, director of Microsoft
Trustworthy Computing in a statement. The zero-day in IE 6-9
is a use-after-free memory corruption vulnerability, similar to a
buffer overflow, that would enable an attacker to remotely execute code
on a compromised machine. The original exploit payload dropped the
PoisonIvy remote access Trojan (RAT) via a corrupted Flash movie file.
The latest payload discovered dropped the PlugX RAT via the same
corrupted Flash movie, Blasco said. He also said the new exploits
are the work of the Chinese hacker group Nitro, the same group behind a
pair of Java zero-day exploits disclosed in August.
Blasco also said the new exploits appear to be targeting defense contractors in the United States and India.
Microsoft recommended several workarounds Tuesday morning before announcing its intention to send out a FixIt.
- Setting Internet and local Internet security zone settings to high, which would block ActiveX Controls and Active Scripting in both zones
- Configure IE to prompt the user before running Active Scripting, or disable Active Scripting in both zones
- Use of Microsoft's Enhanced Mitigation Experience Toolkit provides mitigations as well, and would not impact website usability, as both of the first two options might.
Microsoft also said that IE
running on Windows Server 2003, 2008 and 2008R2 runs in a restricted
mode that mitigates the vulnerability. Outlook, Outlook Express and
Windows Mail also open HTML messages in a restricted zone, mitigating
the vulnerabilty but should a user click a link in a message, they could
still be vulnerable to exploit.
LINK TO OUR HOME PAGE :
Voice Of GREYHAT is a non-profit Organization propagating news specifically related with Cyber security threats, Hacking threads and issues from all over the spectrum. The news provided by us on this site is gathered from various Re-Sources. if any person have some FAQ's in their mind they can Contact Us. Also you can read our Privacy Policy for more info.
Thank You !
-Team VOGH
If you enjoyed VOGH News, Articles Then Do Make sure you to Subscribe Our RSS feed. Stay Tuned with VOGH and get Updated about Cyber Security News, Hacking Threads and Lots More. All our Articles and Updates will directly be sent to Your Inbox. Thank You!
-Team VOGH
Categories:
Browser
,
download
,
flash player
,
IE
,
Microsoft
,
Security Patch
,
security-news
,
technews
,
vulnerablity
