CIO Today HOME LATEST NEWS NEWSLETTERS SEARCH Search
  LATEST NEWS FOR MONDAY FEBRUARY 27

Close Search Box
CIO Today
NETWORK SECURITY
Microsoft Releases 'Fix It' for Zero-Day Vulnerability
Posted February 21, 2014
Microsoft Releases 'Fix It' for Zero-Day Vulnerability
Next Story
EARLIER
Skyhigh Networks Unveils Dashboard for Cloud Risk
THIS STORY
Microsoft Releases 'Fix It' for Zero-Day Vulnerability
Next Story
LATER
Apple Pushes iOS Update To Fix Epic Security Blunder
YOU ARE HERE:   HOME arrow NETWORK SECURITY arrow THIS STORY
NEWS OPS

By Jennifer LeClaire. Updated February 21, 2014 12:49PM

SHARE

ALSO SEE

Redmond has issued a fix for the so-called watering hole attack. Microsoft confirmed reports last week of an active campaign attack affecting Internet Explorer 10 users.

Since then, it turns out IE 9 users are also at risk, but anyone using older versions are immune. The good news: Microsoft is pushing out a “Fix it” solution called "MSHTML Shim Workaround" it says prevents the exploitation of this issue.

“The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” Microsoft said in a security advisory.

“The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site.”

Social Engineering at Play

There are mitigating factors. For example, IE on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 runs in a restricted mode that is known as Enhanced Security Configuration by default. This mode mitigates this vulnerability. But the risks are real for many.

“An attacker who successfully exploited this vulnerability could gain the same user rights as the current user,” Microsoft said. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”

In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. Microsoft said compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability.

“In all cases, however, an attacker would have no way to force users to visit these Web sites,” the company explained. “Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.”

A Fix is Not a Patch

We caught up with Tyler Reguly, manager of security research for Tripwire, to get his take on the release. He told us it’s important to make the distinction here between a Fix it solution and a patch.

“This is not a patch. It is a workaround that you can download from the Microsoft Web site,” Reguly said. “The average enterprise or individual is unlikely to deploy this Fix it. They are great options for the security minded but the average Joe is still going to be vulnerable.”

Reguly compared it to a leaky roof. What Microsoft is offering up, he said, is the equivalent of placing a thimble under the leak. In other words, you'll catch a few drips but ultimately it's ineffective over the long term.

“In order for Fix it solutions to truly be effective, Microsoft needs to have a way to push them out to all users and I don't see them doing that with a workaround. There are too many potential compatibility issues and workarounds don't generally see the same rigorous testing that patches do,” Reguly said.

“It'd be interesting to statistics regarding how many people view the Fix it page versus those that download the Fix it versus those that apply the Fix it. I wonder if Microsoft has any of those numbers and would be interested in releasing them," he added.

Tell Us What You Think
Comment:

Name:

MORE IN NETWORK SECURITY

Next Article >

NETWORK SECURITY SPOTLIGHT
This Spotlight
Is Brought to You By:

INSIDE CIO TODAY NETWORK SITES SERVICES BENEFITS