It looks as if the zero-day vulnerability in Microsoft’s Internet Explorer that has been key to multiple exploits in the wild will finally meet its patch with this month’s Patch Tuesday releases, and none too soon.

Microsoft recently published an emergency security advisory in response to reports of a zero-day vulnerability found in the company’s Internet Explorer browser that could allow for remote code execution by attackers.

“The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” Microsoft’s advisory stated.

Researchers  have already shown that exploits taking advantage of the vulnerability have been used in a water-hole style attack dubbed “Operation DeputyDog” since at least mid-August, and may have been used to compromise security vendor Bit9 earlier this year.

Other researchers discovered that the exploit was also being used to serve up malware by way of compromised website belonging to Taiwan’s Government e-Procurement System, pushing the IE zero-day exploit timeline back to at least July 1, 2013.

Last week developer Wei Chen released an exploit module for Metasploit that contains the same code that attackers have been using, and some experts warned that the release could lead to an escalation in attacks.

In this month’s Patch Tuesday releases, Microsoft will correct four vulnerabilities rated as being critical, and four more rated as important for products including the .NET Framework, Windows, Microsoft Office, and the already mentioned Internet Explorer zero-day.

Read More Here…

Categories:

Tags: , , , , , , , , , , ,


Leave a Reply

Anthony M Freed

Anthony M Freed has contributed 484 posts to The State of Security.

View all posts by Anthony M Freed >