Microsoft Issues Emergency Fix For Internet Explorer Zero Day (bleepingcomputer.com) 39
An anonymous reader quotes a report from Bleeping Computer: Microsoft has released an out-of-band security update that fixes an actively exploited vulnerability in Internet Explorer. This vulnerability has been assigned ID CVE-2018-8653 and was discovered by Google's Threat Analysis Group when they saw the vulnerability being used in targeted attacks. According to Microsoft's security bulletin this is vulnerability in how the Internet Explorer scripting engine handles objects in memory. Attackers can use this vulnerability to corrupt memory in such a way that attackers could execute code under the security privileges of the logged in user. This vulnerability can also be used to launch attacks through specially crafted web sites that utilize the exploit code. This means that attackers can utilize this feature in exploit kits or by compromising legitimate sites and adding code that exploits the vulnerability.
"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer," states Microsoft's advisory. "The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."
"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer," states Microsoft's advisory. "The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."
Linux can't move this fast (Score:2, Funny)
No more JIT! (Score:4, Interesting)
It's become obvious that JIT is a persistent threat that cannot reliably be tamed. If browser makes actually cared about security that would at least make it an option to disable JIT and use an interpreter in it's place. Sadly, it's the browser wars have become a race to see who can run the most garbage scripts as fast as possible and damn the consequences.
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:1)
Or dropping Trump's name somehow.
Re: (Score:2)
It doesn't do that any more, you insensitive clod.
MS has implemented IE blockchain in a proprietary cryptocurrencyized algorithmic preanalyticalization of cloud-based JIT.
Re: (Score:2)
Still need it to install another browser on Windows initially. Well not necessarily need, but a lot less annoying to do.
Explorer? (Score:2)
Re: (Score:3)
Internet Explorer? (Score:2)
Why are Microsoft still releasing patches for Internet Explorer? Didn't it get replaced by Edge years ago?
Re:Internet Explorer? (Score:4, Insightful)
In this instance, with the word "infrastructure" I don't necessarily mean the physically tangible things, but rather the intangible things like bespoke software or other similar things developed for one particular company's internal needs.
Re: Internet Explorer? (Score:2)
Re: (Score:3)
Microsoft tried to help with this. They hide the ie icon, make Edge the default browser, and try to schlep you back into Edge if/when you launch IE.
Enterprises are the primary users of IE now because of fear of breaking things, custom, or real application compatibility requirements.
P.s. if you have real application compatibility requirements, take a look at Enterprise Mode. One of its features is you can use Edge and hav
Re: (Score:2)
I'm running an XP box with a registry hack* [pcworld.com] that makes it think it's an ATM or other embedded OS. I still get security updates.
The only goddam browser that will work on it is IE.
Not that any web sites understands what the fuck it is ...
*Windows XP registry hack keeps security updates rolling for the dead operating system
Re: (Score:2)
We still have a couple legacy apps that are IE only. :(
It's sad. We've been saying for years that this is a problem and it needs replaced, but it's still there. So it sucks that we can't remove it from our machines, and it's good they're still doing security updates.
Re: (Score:2)
Windows, before 10, doesn't have Edge. :P
well (Score:2)
Re: (Score:2)
Try millions [windowslatest.com] of users (April 4, 2018 ) both corporate and private. I use one for security camera duty.
Windows XP has more market share than the top version of macOS.
Re: (Score:2)
You're not aware that I'm a retired IT guy. Should you decide to enter the field, you, too will know what the fuck you're talking about. I don't rely on a "they."
Windows XP, to this day, receives security updates.
Re: (Score:2)
I was hoping you would bite [hexus.net].
Registry hack enables Windows XP security updates until 2019
by Mark Tyson on 27 May 2014, 11:12
Bazinga!
Not a zero-day (Score:2)
A zero day means "The software company has known about it for zero days." There won't be many defenses against it, because it's been known about for zero days. In this case, Microsoft has known about it for a few days at least, and there is a patch available. So it is a 10 day exploit, or 15 day exploit.
Re: Not a zero-day (Score:1)
What are you going on about? It was discovered by Google being exploited in the wild before Microsoft knew about it. That's the basically the textbook definition of a zero day.
Re: (Score:2)
What are you going on about? It was discovered by Google
Yes, it was a zero day. Once Microsoft knew about it, it became a day-1 exploit. (Whether it was being exploited in the wild or not is irrelevant).
Re: (Score:1)