Slashdot Mirror
HP Researchers Disclose Details of Internet Explorer Zero Day
Trailrunner7 writes: Researchers at HP's Zero Day Initiative have disclosed full details and proof-of-concept exploit code for a series of bugs they discovered that allow attackers to bypass a key exploit mitigation in Internet Explorer. The disclosure is a rarity for ZDI. The company typically does not publish complete details and exploit code for the bugs it reports to vendors until after the vulnerabilities are fixed. But in this case, Microsoft has told the researchers that the company doesn't plan to fix the vulnerabilities, even though the bugs were serous enough to win ZDI's team a $125,000 Blue Hat Bonus from Microsoft. The reason: Microsoft doesn't think the vulnerabilities affect enough users.
The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization), one of the many mitigations in IE that help prevent successful exploitation of certain classes of bugs. ZDI reported the bugs to Microsoft last year and disclosed some limited details of them in February. The researchers waited to release the full details until Microsoft fixed all of the flaws, but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems.
The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization), one of the many mitigations in IE that help prevent successful exploitation of certain classes of bugs. ZDI reported the bugs to Microsoft last year and disclosed some limited details of them in February. The researchers waited to release the full details until Microsoft fixed all of the flaws, but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems.
Even Microsoft doesn't care about Internet Explorer anymore, why should we?
Get free satoshi (Bitcoin) and Dogecoins
some people still use that crap?
So, Microsoft thinks there aren't many people with 32-bit versions of Windows that use vulnerable versions of Internet Explorer.
Even if they are wrong today, they will be right as soon as word of this gets out and people start panicking.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The exploit allows attackers to steal cookies for localhost. Great. What, exactly, are you going to do with a stolen localhost cookie? It's a non-routable IP address!
The worst attack I can think of involves CSRF, which is a flaw in the web service.
I think MS was right not to care. Who's running 32 bit Windows in 2015, anyhow?
"is not too rare" per TFA. That seems to be part of said vulnerability. I've had some major clients run a localized IIS / SQL This won't effect the majority of users then, but it will specifically effect a huge number of corporate users. One client that has a setup that would be affected, with 5000+ users...who also have very juicy account info, at least for other large pharma corps who are also doing trials on diabetic drugs, cardio drugs, etc.
Siriusly...
> but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems.
Hi, US Navy. How's life going?
You know, when you think why Munich adopted Linux... this is one of the reasons.
@anonymous coward: "The exploit allows attackers to steal cookies for localhost"
'The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization' ref
Does this mean that ASLR and DEP were ineffective in all versions of Windows since WinXP in 2004?
Microsoft: the company that made web browsing, opening email and text editing dangerous
I could have read about this on Secunia, my windows xp would have never had any problems.
Oh wait, I only run linux in my house.
I wonder if this would affect my university's network.
The IT dept here has never deployed 64bit windows.
When I asked about this because I was surprised to see 32bit windows running on a machine with 8Gigs of RAM they answered that the 64 bit version never went through their (expensive) vetting process.
Because there's a CS dept all machines have an apache server listening on localhost.
> ... but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems. ... but Microsoft later informed them that they didn't plan to patch the remaining bugs because those are currently in active use as part of NSA e-espionage oparations and all the redmondite are patriotic and loyal american citizens.
The documented exploits are almost completely worthless, especially: "As for local IP address disclosure, this can be used to map an organization behind a NAT,"
Guess this 'researcher' has never considered using IPv6.
The vulnerability described in the first link appears to be completely unrelated to the vulnerability discussed in the second link. One is a straightforward information exposure vulnerability, the other is a counter-mitigation technique that bypasses ASLR.
I've checked the detailed reports, too; neither "ASLR" nor "mitigation" appear in the first report, and neither "cookies" nor "localhost" appear in the second report. They're from different people and different organizations. Apart from the fact that they both affect IE, they've got nothing to do with one another.