Slashdot Mirror
Microsoft Patches OLE Zero-Day Vulnerability
msm1267 writes: Microsoft today released a patch for a zero-day vulnerability under active exploit in the wild. The vulnerability in OLE, or Microsoft Windows Object Linking and Embedding, enables a hacker to remotely execute code on an infected machine, and has been linked to attacks by the Sandworm APT group against government agencies and energy utilities. Microsoft also issued a massive Internet Explorer patch, but warned organizations that have deployed version 5.0 of its Enhanced Mitigation Experience Toolkit (EMET) to upgrade to version 5.1 before applying the IE patches. Version 5.1 resolves some compatibility issues, in addition to several mitigation enhancements.
It's Patch Tuesday falling on Veteran's Day this year... so this may catch some IT staff sleeping. Everybody checking Slashdot at home who maintains one of these things... log in an apply the update!
In many cases, XP vulnerabilities are minimal. Don't use Internet Explorer. Every user should have limited rights. Users should be trained not to open files that haven't been arranged in advance. Use a software firewall that monitors outgoing traffic.
Most writers for technical publications have limited technical knowledge. What is not said in the article linked by Slashdot is that computers that run software firewalls that monitor outgoing traffic are far more protected.
Quoting from the article: "For this attack scenario to be successful, the user must be convinced to open the specially crafted file containing the malicious OLE object. All Microsoft Office file types as well as many other third-party file types could contain a malicious OLE object."
Another quote: "A successful exploitation could lead to the attacker gaining same user rights as the current user, and if that means administrative user rights, the attacker can install programs; access, modify, or delete data; or create new accounts with full user rights."
This article explains some of the issues: Microsoft Windows XP "end of life": Conflict of interest.
how is this zero day.. ithe summary says -> released a patch for a zero-day vulnerability under active exploit in the wild. - how the heck is that a zero day ploit? more like shudda beeen paytched looooong time ago.