Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Internet Explorer Microsoft Security

Microsoft Patches Remote Code Execution Hole for Internet Explorer 56

mask.of.sanity writes: Microsoft has released an out-of-band patch for Internet Explorer versions seven to 11 that closes a dangerous remote code execution flaw allowing attackers to commandeer machines. From their advisory: "An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Systems where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability." The attack could assist in watering hole and malvertising campaigns. The Windows 10 Edge browser is not impacted.
This discussion has been archived. No new comments can be posted.

Microsoft Patches Remote Code Execution Hole for Internet Explorer

Comments Filter:
  • Yeah Well (Score:2, Troll)

    by Greyfox ( 87712 )
    Fortunately they'll be rid of it soon! Everyone will move to Windows 10 and their shiny new Edge browser, which I'm sure was created as a completely bug-free code-base with a fuck-ton of unit tests to prevent regressions!

    Ow. I think I hurt myself trying to make it through that post with a straight face.

  • Like the first program I remove is IE.
    • Re:Who uses IE? (Score:5, Informative)

      by Dutch Gun ( 899105 ) on Tuesday August 18, 2015 @11:57PM (#50344379)

      It's what everyone uses for downloading Firefox or Chrome on a new Windows machine.

      • It's what everyone uses for downloading Firefox or Chrome on a new Windows machine.

        Not everyone. I use a USB stick on which stands the latest Ubuntu release to add a Linux OS on the machine. This is yet another way to install Firefox, but at least it doesn't depend upon IE.

    • Look around you. If there are 8 people in the room then one of them is using IE. If your room is full of statistically representative samples of the internet.

      I congratulate you for not using IE. That doesn't mean there aren't literally millions of IE users out there.

    • by antdude ( 79039 )

      Computer newbies, businesses, etc. :(

  • by Anonymous Coward

    ...all that is unholy.

    " If the current user is logged on with administrative user rights , an attacker who successfully exploited this vulnerability could take complete control of an affected system."

    When is MicroSoft going to get off their butts and fix their operating systems so that the first user is not defaulted to administrator rights or at least have the first user forced to make a 'normal' user account for normal usage? Even 'ancient' Linuxs only add the first user to sudoers so that they have to ex

    • Re: (Score:3, Insightful)

      by benjymouse ( 756774 )

      When is MicroSoft going to get off their butts and fix their operating systems so that the first user is not defaulted to administrator rights or at least have the first user forced to make a 'normal' user account for normal usage? Even 'ancient' Linuxs only add the first user to sudoers so that they have to explicitly invoke rootly powers.

      Unlike Linux, Windows uses proper security tokens. Each process has it's own token governing what it can do to which resources. On Linux the "token" is - rather naively - a user id.

      When you log on to Windows - since Vista - with an account with administrative rights, thee token that is created for the shell process is 1) stripped of all administrative rights and 2) given an integrity level of "normal". Integrity levels are also part of the token.

      What it means is that *even when you log on as an administrato

      • @benjymouse: "When you invoke a program that has a manifest which states that it requires some form of administrative rights, Windows will prompt you for "elevated" privileges. Only when you accept to use your administrative privileges will the process be started with a token with higher than standard user rights. It really is a much more elegant solution than the stupid effective user in Linux."

        $su -c command ..
      • by gl4ss ( 559668 )

        funny thing is that malware never seems to have any trouble elevating the rights without asking the user, while for legitimate software the user gets bombarded with prompts.

        it's useless.

        just like on osx as well the separation is useless. malware finds a way around.

      • Or it fails with the message "Something happened". Whoever thought that was an appropriate message should be beaten with a rubber hose.

        • by tlhIngan ( 30335 )

          Whoever thought that was an appropriate message should be beaten with a rubber hose.

          Well, technically it's an unexpected error. Which happened because your locale was not set to "en-us" - everyone who saw it generally was outside the US - Australia (en-au), Canada (en-ca), etc. For whatever reason, the tool accesses something by the locale rather than language, so when it tried to find an en-ca or en-au or en-uk image, it fails. Given it's something that shouldn't ever fail, well...

      • by cbhacking ( 979169 ) <been_out_cruising-slashdot@@@yahoo...com> on Wednesday August 19, 2015 @04:02AM (#50345059) Homepage Journal

        It actually goes a bit beyond this: even since Vista, IE has (by default) run with a *restricted* token that has even less privileges than the normal use. It is Low integrity level, meaning it can't interact with Medium integrity processes or write to most of the file system, registry, or other secured resources.

        Unfortunately, as Microsoft is wont to do, they fucked up the sandbox. The default configuration of IE only uses Protected Mode (Low IL) for the Internet and Restricted security zones. Notably, this excludes pages hosted on the local machine. Now, if you've got a code execution bug in IE, you can use that to run a webserver (on localhost). That webserver can host the exploit itself. Then you direct your hijacked, sandboxed IE to the localhost page, watch as the tab's process gets re-launched with normal privileges, and then you compromise that new process. You can protect yourself from this by going to Internet Options -> Security -> Local Intranet -> Enable Protected Mode.

        Similarly, the default "Don't notify me when I make changes to Windows settings" feature of UAC in Win7 (and above) is breakable; it's possible to get from medium IL to High IL (Administrator) if you have it enabled and are logged in as a member of the Administrators group. The fix is simple - just set it back to always prompting even for Windows settings (or do what I do, and have it actually ask for your password Sudo-style, though you need to use the Local Security Policy editor, secpol.msc, for that), or run as a non-member of Administrators - but most people never do any of these things.

        Microsoft is aware of both issues, and has issued no fixes for them. The POC program to silently elevate an arbitrary binary from Medium IL is blocked by Windows Defender (and probably other antivirus programs) but it would be easy enough to disguise it in such a way that the AV programs miss it.

      • by Kjella ( 173770 )

        When you invoke a program that has a manifest which states that it requires some form of administrative rights, Windows will prompt you for "elevated" privileges. Only when you accept to use your administrative privileges will the process be started with a token with higher than standard user rights. It really is a much more elegant solution than the stupid effective user in Linux, where the description of a process rights is strongly tied to a user: There must exist a user with the specific sets of rights you want the process to have.

        It's possible they have more fine grained control behind the scenes but since the UAC prompt doesn't tell me anything I have to assume that any time I click yes that process can do anything, much like "sudo" on the Linux side. It might be ready for role-based security like on cell phones where they list the particular privileges the application wants, but I don't see it in practice.

The world is coming to an end--save your buffers!

Working...