Slashdot Mirror
HP Researchers Disclose Details of Internet Explorer Zero Day
Trailrunner7 writes: Researchers at HP's Zero Day Initiative have disclosed full details and proof-of-concept exploit code for a series of bugs they discovered that allow attackers to bypass a key exploit mitigation in Internet Explorer. The disclosure is a rarity for ZDI. The company typically does not publish complete details and exploit code for the bugs it reports to vendors until after the vulnerabilities are fixed. But in this case, Microsoft has told the researchers that the company doesn't plan to fix the vulnerabilities, even though the bugs were serous enough to win ZDI's team a $125,000 Blue Hat Bonus from Microsoft. The reason: Microsoft doesn't think the vulnerabilities affect enough users.
The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization), one of the many mitigations in IE that help prevent successful exploitation of certain classes of bugs. ZDI reported the bugs to Microsoft last year and disclosed some limited details of them in February. The researchers waited to release the full details until Microsoft fixed all of the flaws, but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems.
The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization), one of the many mitigations in IE that help prevent successful exploitation of certain classes of bugs. ZDI reported the bugs to Microsoft last year and disclosed some limited details of them in February. The researchers waited to release the full details until Microsoft fixed all of the flaws, but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems.
Even Microsoft doesn't care about Internet Explorer anymore, why should we?
Get free satoshi (Bitcoin) and Dogecoins
So, Microsoft thinks there aren't many people with 32-bit versions of Windows that use vulnerable versions of Internet Explorer.
Even if they are wrong today, they will be right as soon as word of this gets out and people start panicking.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Exactly what I was thinking. They're right, the vulnerability doesn't effect enough users: it's in Internet Explorer.
"is not too rare" per TFA. That seems to be part of said vulnerability. I've had some major clients run a localized IIS / SQL This won't effect the majority of users then, but it will specifically effect a huge number of corporate users. One client that has a setup that would be affected, with 5000+ users...who also have very juicy account info, at least for other large pharma corps who are also doing trials on diabetic drugs, cardio drugs, etc.
Who's running 32 bit Windows in 2015, anyhow?
Some low power/low RAM tablets/hybrids are shipping brand new today with 32-bit windows. 32bit OS can use a smaller memory footprint, and can actually be faster under some workloads.
and how many of those low powered devices are shipping with a web server or equivalent that is publishing localhost cookies (the second part of the requirement to get anything from the machine).
What else will you download Firefox with on a new system?
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
@anonymous coward: "The exploit allows attackers to steal cookies for localhost"
'The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization' ref
I keep hearing this claim, and I see no evidence for it. Shit, I worked for redmond for years, and IE was *never* faster outside of a lab than Firefox, much less Chrome. I didn't particularly care for the immense amount of telemetry that Chrome shipped back to the goog, but it started fast and stayed that way. A fresh copy of IE/WIn8 on the other hand, was zippy for the first few days of use -- almost as fast as firefox on 32 or 64 -- but quickly bogged down with local cache writes and content inspection, tons of default temetry, and helper libraries that could not be unloaded without heading into the registry with an army of villagers weilding pitchforks and torches. Besides, it's UGLY. Why bother with it?
I think not...(*poof*)
What else will you download Firefox with on a new system?
c:\> ftp ftp.mozilla.org
n00b.
The documented exploits are almost completely worthless, especially: "As for local IP address disclosure, this can be used to map an organization behind a NAT,"
Guess this 'researcher' has never considered using IPv6.
srslah
- Dan
The vulnerability described in the first link appears to be completely unrelated to the vulnerability discussed in the second link. One is a straightforward information exposure vulnerability, the other is a counter-mitigation technique that bypasses ASLR.
I've checked the detailed reports, too; neither "ASLR" nor "mitigation" appear in the first report, and neither "cookies" nor "localhost" appear in the second report. They're from different people and different organizations. Apart from the fact that they both affect IE, they've got nothing to do with one another.
These are two unrelated issues - a vulnerability which affects machines that have web servers running on localhost, and a counter-mitigation technique that affects IE running on 32-bit Windows. Those machines are probably affected by both issues, but the first will probably be patched in due course and the second isn't an exploit as such but a method of making other exploits more effective.
There are a number of mitigation techniques that either don't exist or aren't as effective on 32-bit Windows. I don't think this one is necessarily a game-changer.
Actually the article confuses two unrelated security issues. Microsoft said they weren't planning to do anything about the counter-mitigation technique, which may allow an attacker to bypass ASLR in IE on 32-bit Windows. The cookie-stealing vulnerability will presumably be patched in due course.
No more so than before. :-)
The mitigations that this research affects weren't introduced until 2014 anyway.
I have to use IE on windows every fucking working day, because certain "enterprise" vendors only make management shit (with flash, of course) that runs on windows. And what's funny is these companies products either use open source OS or core open source services on their products, without fail.