Researchers Reveal New IE Zero-Day Vulnerability

UPDATE

from WinCustomize Forums

 

I wasn't planning on posting today, but when I read this, I felt I should whip something up quickly.

Security researchers have released attack code that exploits an unpatched bug in Microsoft's Internet Explorer (IE) and sidesteps defenses baked into Windows 7.

Microsoft late Wednesday confirmed that all versions of Internet Explorer (IE) contain a critical vulnerability that attackers can exploit by persuading users to visit a rigged Web site. The site can then hijack personal data and install malicious code and/or malware. This will bypass all security software and Windows 7 protestion. Network Administrators and IT Professionals can download EMET 2.0 from MS who claim it can be configured to protect servers.

MS Security Advisory (2488013) HERE.

Although the company said it would patch the problem, it is not planning to rush out an emergency update.

The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.

The vulnerability in IE6, IE7 and IE8 surfaced several weeks ago when French security firm Vupen disclosed a flaw in IE's HTML engine.

The bug first surfaced earlier this month when French security firm Vupen announced it had uncovered a flaw in IE's HTML engine, however the vulnerability was noted and explained earlier in a Chinese trade publication.

Doc suggests using Firefox, Opera, or any non iE based browser until this vulnerability is patched.

 

 

164,930 views 95 replies
Reply #1 from Elemental Forums Top

Thanks for the heads up. As an aside, does anyone know why they call them Zero-day vulnerabilities? I've always wondered.

Reply #2 from WinCustomize Forums Top

IE sucks. IE (and Microsoft in general) is and always has been the primary target for most hackers, malware, etc. Today there are too many great alternative browsers (FireFox, Opera, Safari, etc.) for anyone to be using it.... <_<

DeskScapes - Bring your desktop background to life.
Reply #3 from Stardock Forums Top

Lightof Abraxis, it's called that "zero-day" -- because the flaw becomes public before a patch is ready to stop its exploitation.

Oh yes, you're welcome.

:)

Quoting navigatsio, reply 2
IE sucks. IE (and Microsoft in general) is and always has been the primary target for most hackers, malware, etc. Today there are too many great alternative browsers (FireFox, Opera, Safari, etc.) for anyone to be using it....
End of navigatsio's quote

I agree Navagatsio, especially now that it's the buggiest and slowest of the browsers.

Reply #4 from WinCustomize Forums Top

Never used IE any version. Always had Firefox. MS will never learn. Dopes!

Reply #5 from WinCustomize Forums Top

The safest way to surf the web is through a Virtual PC session with whatever browser you choose.

As long as you disgard all changes when you close out your Virtual PC, there's no chance of infections or malware.

Reply #6 from WinCustomize Forums Top

Tried BufferFree but didn't like what it did to the rest of my software.

 

Reply #7 from WinCustomize Forums Top

Virtual PC session
End of quote

Please elaborate. Virtual PC session?

Reply #8 from WinCustomize Forums Top

Thanks again Doc, and thanks for including the link to the Advisory - it's well worth reading.

I keep thinking about trying out FireFox, mainly just for fun, now could be a good time.:\

Reply #9 from WinCustomize Forums Top

The 3.8 Beta is out...lotsa great extensions for earlier builds...not ready for the 3.8 yet.

The ff 4.0 should be out in January.

Opera 11 is blazing fast, and has really good extensions, too.

Reply #10 from WinCustomize Forums Top

blazing fast
End of quote

Well now that certainly sounds like a nice change from IE :)

Reply #11 from JoeUser Forums Top

I've been test driving FF4 Beta 7 & 8.  Initial/home page loads fine but page loads in additional tabs are hanging for 20-30 seconds during which time FF is entirely unresponsive.  Recovers but then happens again with the next page load.

FF3.6.13 is doing the same thing only when it hangs it stays crashed & has to be killed with TM.

No such troubles with IE7 on same pages.

I think I'll grab a copy of Opera & use it for a little while till FF gets things sorted out.

Reply #12 from WinCustomize Forums Top

Quoting Uvah, reply 7

Virtual PC session


Please elaborate. Virtual PC session?
End of Uvah's quote

Microsoft Virtual PC 2007

 

It' also called XP Mode in Windows 7.

Reply #13 from WinCustomize Forums Top

IE with vulnerabilities ... never. /sarcasm

The only thing stopping my move from FF to Opera is Noscript. I hope someone will make an extension like it for Opera.

Opera does have problems with some web sites, but they are few and far between.

I have not had any major problems with FF4 Beta 7, only some add-ons won't work and my password manager dies. But with a beta of a browser you can't expect safe browsing. 

Until then my clunky old FF will have to do. -_-

Reply #14 from WinCustomize Forums Top

My ff doesn't do that Daiwa, but Opera is really great. I think you;ll love it.  :thumbsup:

Reply #15 from JoeUser Forums Top

Not sure why the hangs/crashes are occurring here with FF3 & FF4, either, obviously.  I've reported them to Mozilla so we'll see.  First started to happen with 3.6.10 I believe.  Had been using FF exclusively (with IE Tab 2 for those occasional finicky pages that just don't cotton to FF) for a long time and never had similar problems, even with 10 or more open tabs (doesn't happen often, but 5-6 is routine).  They've made both FF3 & FF4 unusable during the workday, just no time to deal with reloads, repeat logins, etc.

I'm liking what I see of Opera so far (using it for this reply), but a real workday will tell the tale.

Reply #16 from WinCustomize Forums Top

I've been using it since it first came out...never disappointed yet!

Lifehacker's Browser Test Results: HERE

Reply #17 from JoeUser Forums Top

Thanks for the link, doc.

Reply #18 from Stardock Forums Top

Quoting DrJBHL, reply 3
Lightof Abraxis, it's called that "zero-day" -- because the flaw becomes public before a patch is ready to stop its exploitation.

especially now that it's the buggiest and slowest of the browsers.

End of DrJBHL's quote

The problem is that 'vulnerability' could be anything from 'can look at the files in one directory' to 'can smite your box.'  MS will usually fix vulnerabilities even when there isn't even a verifiable threat due to other safeguards.

I haven't used IE8 in ages but I've been back on the IE9 beta for a while and loving it.  Can't wait for the RC.

Reply #19 from WinCustomize Forums Top

Let me eat my words, NotScript for Opera

Looks like I will be using Opera from now on ^_^

Reply #20 from Demigod Forums Top

yeah -started using noscript a few days ago.  Not sure if this is a bad as it sounds in the OP from reading the security bulletin, but doesn't matter much to me as I'm using firefox. 

Reply #21 from WinCustomize Forums Top

Quoting Savyg, reply 18

Quoting DrJBHL, reply 3Lightof Abraxis, it's called that "zero-day" -- because the flaw becomes public before a patch is ready to stop its exploitation.
especially now that it's the buggiest and slowest of the browsers.


The problem is that 'vulnerability' could be anything from 'can look at the files in one directory' to 'can smite your box.'  MS will usually fix vulnerabilities even when there isn't even a verifiable threat due to other safeguards.

I haven't used IE8 in ages but I've been back on the IE9 beta for a while and loving it.  Can't wait for the RC.
End of Savyg's quote

 

From my OP:

Although the company said it would patch the problem, it is not planning to rush out an emergency update.

The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.
End of quote

Reply #22 from Demigod Forums Top

Quoting OMG_pacov, reply 20
yeah -started using noscript a few days ago.  Not sure if this is a bad as it sounds in the OP from reading the security bulletin, but doesn't matter much to me as I'm using firefox. 
End of OMG_pacov's quote

oh and don't get me wrong, please.  I'm really glad you took the time to post this.  TY!

Reply #23 from WinCustomize Forums Top

Hmm, just loaded up Opera and I've got to admit, it's pretty perky.  In terms of browsing it kind of feels like I've upgraded my processor a few clicks.  "I think this could be the start of a beautiful relationship"  :P

My Rust-Bucket and I thank you Doc.

Reply #24 from WinCustomize Forums Top

You're welcome, DaveRI. :)

Another thought for safe browsing is installing and browsing through Microsoft's Virtual Machine 2007 (TY CarGuy1).

Reply #25 from WinCustomize Forums Top

Just went and downloaded Opera. One thing is different, opening a new tab and seeing a bunch of thumbnails with each one linked to a website. Cool. Now all I gotta do is open click and I'm off. Not going for the boost thingy yet. This is pretty fast as it is. Another thing I'm liking, more real estate to work with. Not so much in the way of thick tool bars.