Microsoft Confirms Internet Explorer 0-Day

Use Netsparker


So during the past weekend, Microsoft confirmed an Internet Explorer 0-day that is actually being used in targeted online attacks.

Vulnerability in Internet Explorer Could Allow Remote Code Execution

It will be interesting to see if they push an out of band patch for this one or just wait for the next Patch Tuesday.

Internet Explorer 0-Day

It’s pretty serious as it effects the whole family including Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.

On Saturday, late in the evening, Microsoft issued a public advisory confirming the existence of a new vulnerability in Internet Explorer that’s being used in targeted attacks online.

The vulnerability was disclosed by researchers at FireEye, who observed attacks against Internet Explorer versions 9 though 11. While criminals seem to be focused on the later releases, all versions of Internet Explorer are affected.

Exploits leveraging the use-after-free vulnerability will bypass protections in ASLR and DEP and gain code execution privileges.

In a blog post, FireEye explains:

“Threat actors are actively using this exploit in an ongoing campaign which we have named Operation Clandestine Fox. However, for many reasons, we will not provide campaign details. But we believe this is a significant zero day as the vulnerable versions represent about a quarter of the total browser market. We recommend applying a patch once available.”


The focus does seem to be on IE9 and 11 (which would be the most commonly used versions on newer operating systems (Windows 7 & 8).

EMET will help Microsoft says..

I would expect them to be pushing out a patch for this ASAP as it’s a pretty serious flaw.

In addition, FireEye researchers stated the group responsible for this exploit has had access to “a select number of browser-based 0-day exploits in the past.”

Moreover, the group is proficient at lateral movement, and have been difficult to track as they rarely reuse command and control infrastructure.

Until a patch is released, Microsoft has said that EMET will help mitigate attacks against this flaw.

Further, versions of Internet Explorer running with the default Enhanced Security Configuration are not at risk, provided that the malicious website used to target the vulnerability isn’t listed in the Trusted sites zone.

This is typically the case for Internet Explorer on Windows Server 2003, Windows Server 2008 (and 2008 R2), and Windows Server 2012 (and 2012 R2).

Microsoft hasn’t said if they will release an out-of-cycle patch for this flaw, only that they’ll take the “appropriate action” once the investigation is completed.

The next Patch Tuesday is due almost two weeks from now on Tuesday 13th May 2014, so that’s a fair bit of exposure if this exploit goes public.

We shall have to wait and see what happens, knowing Microsoft – not a lot.

Source: Network World

Posted in: Exploits/Vulnerabilities, Windows Hacking

, , , , , ,


Latest Posts:


BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.


Comments are closed.