Microsoft on Wednesday issued a security advisory to users of its Internet Explorer Web browser about a newly disclosed vulnerability that could be exploited and used to run malicious code on vulnerable Windows systems.
The Redmond, Washington company said it is investigating new, public reports of a vulnerability in all supported versions of IE. The company said it is working on a patch and cooperating with anti malware vendors in its Microsoft Active Protections Program (MAPP) and Microsoft Security Response Alliance to help expedite the distribution of protections against exploits using the hole. However, the company cautioned that the newly discovered vulnerability is not serious enough to warrant an out of cycle patch.
As reported by Threatpost, the new vulnerability was first disclosed by the IT security firm Vupen on December 9 and affects most versions of Microsoft's Internet Explorer Web browser. If exploited, the hole could allow remote attackers to circumvent defensive features in fully patched WIndows 7 and Windows Vista machines, and attack Microsoft's latest version of Internet Explorer, IE8 to run malicious code on vulnerable systems.
[...]
In its advisory, Microsoft said that existing features like IE Protected Mode and the default Enhanced Security Configuration for newer versions of IE on Windows Server 2003 and 2008 would mitigate the impact of the vulnerability by reducing the privileges that attackers have on Windows systems should they successfully compromise IE.
However, a version of a public exploit has already been added to the Metasploit Framework, a free testing tool. That, when combined with other attack techniques, could allow attackers to circumvent more recent Microsoft protections such as Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR), which are specifically designed to thwart malicious code.
In a separate post, Fermin J. Serna, a Security Software Engineer at Microsoft explained how those technologies might be circumented and suggested a workaround to prevent them from being defeated in an attack using the new IE hole.
-------------------------------------------------------------------------------------------------------
Internet Explorer CSS Recursive Import Use After Free
http://www.metasploit.com/modules/exploit/windows/browser/ms11_xxx_ie_css_import
Microsoft - SRD
New Internet Explorer vulnerability affecting all versions of IE
http://blogs.technet.com/b/srd/archive/2010/12/22/new-internet-explorer-vulnerability-affecting-all-versions-of-ie.aspx
Today we released Security Advisory 2488013 to notify customers of a new publicly-disclosed vulnerability in Internet Explorer (IE). This vulnerability affects all versions of IE. Exploiting this vulnerability could lead to unauthorized remote code execution inside the iexplore.exe process.
Recommendation: Use Enhanced Mitigation Experience Toolkit (EMET) to dynamically rebase all loaded DLLs (aka Mandatory ASLR)
No comments:
Post a Comment