Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Patches Remote Code Execution Hole for Internet Explorer

Posted by Soulskill on from the gift-that-keeps-on-giving dept.

mask.of.sanity writes: Microsoft has released an out-of-band patch for Internet Explorer versions seven to 11 that closes a dangerous remote code execution flaw allowing attackers to commandeer machines. From their advisory: "An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Systems where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability." The attack could assist in watering hole and malvertising campaigns. The Windows 10 Edge browser is not impacted.

56 comments

  1. Really by Anonymous Coward · · Score: 0, Interesting

    This bug has been around since IE 7? Wow, this just confirms that MS will only patch bugs once others find them and then they have to work on fixing them.

    1. Re:Really by Anonymous Coward · · Score: 3, Funny

      Wait, so IE6 isn't affected???

    2. Re:Really by hcs_$reboot · · Score: 2, Insightful

      This bug has been around since IE 7? Wow, this just confirms that MS will only patch bugs once others find them and then they have to work on fixing them.

      Most IEs, even the recent ones, suffer from this bug. MS revealing these long standing issues affecting IE... isn't it a good way to promote Edge, the new MS browser not affected by this bug?

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    3. Re:Really by Anonymous Coward · · Score: 1

      isn't it a good way to promote Edge, the new MS browser not affected by this bug?

      It certainly is. The update also probably goes ahead and downloads Edge for you, since they know you obviously need it. And since Edge only runs on Win10, the update probably downloads that for you, too. All part of the new Microsoft: patting you on the head and tucking you in at night.

    4. Re:Really by Zero__Kelvin · · Score: 2

      " isn't it a good way to promote Edge, the new MS browser not affected by this bug?"

      Of course it is, in the same way that discovering that all the models of a car made by a certain company to date explode on impact makes me want to run right out and buy their slightly different newest model designed and manufactured by the same company.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    5. Re:Really by Rockets84 · · Score: 3, Insightful

      This bug has been around since IE 7? Wow, this just confirms that MS will only patch bugs once others find them and then they have to work on fixing them.

      So, what's your point? IE 7 through to 11 use the same Trident layout engine so it stands to reason one security flaw could affect IE 7 through to 11. Heartbleed was in OpenSSL's source for 3.5 years & Shellshock was in BASH since 1989 before anyone found them. Bugs can exist in software for years whether they are open or closed source.

    6. Re:Really by U2xhc2hkb3QgU3Vja3M · · Score: 1

      Better boot up my XP box and let it update, then!

      Free Windows 10 at last! Woo-hoo!

    7. Re:Really by teh+dave · · Score: 1

      Yeah, but that doesn't matter. What matters is that this is Slashdot, and therefore whatever Microsoft does they're automatically Satan and must be derided.

  2. Every Tuesday Is Patch Tuesday by sexconker · · Score: 0

    Fuck it. It can wait 3 weeks.

    1. Re:Every Tuesday Is Patch Tuesday by DigiShaman · · Score: 1

      I suspect this is how CryptoWall 3.0 is getting machines infected.

      --
      Life is not for the lazy.
    2. Re:Every Tuesday Is Patch Tuesday by Anonymous Coward · · Score: 0

      It is - here's an MD5 we saw yesterday 03c96a0f-0f66-8381-d7de-b0d99151d372 of the dropped file. -T

  3. No IE 6??? by Anonymous Coward · · Score: 0

    What about IE 6? There's still alot of us that need to use this browser until Oracle decides to get their butt in gear.

    1. Re:No IE 6??? by Anonymous Coward · · Score: 0

      If you are still reliant on Oracle for browser connectivity it is you guys that need to get your butts into gear. You should have migrated away from that shit years ago.

    2. Re:No IE 6??? by timrod · · Score: 2

      Some companies simply can't migrate away from old software because of the nature of their business. I worked for a place that used a copy of JD Edwards (a godawful inventory management system from the 90s that was nearly sued into oblivion because of how buggy it was) that had last been patched in 1998, simply because they would have had to get authorization from the government to upgrade and that would have cost the company a bunch of money.

    3. Re:No IE 6??? by viperidaenz · · Score: 1

      You shouldn't be running XP, It and IE6 are no longer supported, haven't been for well over a year now.

    4. Re:No IE 6??? by Anonymous Coward · · Score: 1

      And that matters how? Who cares if it isn't supported by MS anymore? It wasn't supported by MS when it was out there really. They only have ever done the bare minimum so it doesn't cut into their profits.

    5. Re:No IE 6??? by Zero__Kelvin · · Score: 2

      "Some companies simply won't migrate away from old software"

      FTFY

      " that would have cost the company a bunch of money."

      Luckily, using buggy antiquated software that is unsupported and no longer receives security updates doesn't incur any cost / overhead at all!

      It always baffles me to see incompetents who can't figure out that the most costly business move a company can make is to stagnate and refuse change with the times.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    6. Re:No IE 6??? by F.Ultra · · Score: 1

      The bare minimum is still support.

    7. Re:No IE 6??? by Anonymous Coward · · Score: 0

      Who gives a shit?

      If it ain't broke, don't fix it. Nobody needs "support".

    8. Re:No IE 6??? by F.Ultra · · Score: 1

      It's IE6 and WinXP, neither which ever could be seen as not broke.

  4. Patch not for Windows XP... by Anonymous Coward · · Score: 0

    Patch not for Windows XP...

    Because: fuck you, you are not paying us money.

    We are going to be disclosing these vulnerabilities, which we have known about for years, and publishing patches for them, one every patch Tuesday, until you fuckers get with the program and get off Windows XP so you can start paying us money again.

    PS: Upgrade your fucking hardware! We get royalties on that shit, and if you upgrade one machine, you're going to have to upgrade all of them to be able to have everyone in the office use the same versions of everything. Yes, we know you are a small business which operates on cash flow, and simply can't afford to do this... fuck you! Become a big enterprise! Why can't you scale your fucking business with a deal with IBM like we did?!?!?

    Love and rockets,
    Your Buddy Microsoft

    1. Re:Patch not for Windows XP... by Anonymous Coward · · Score: 1

      XP is fine, but why use IE on XP anyways???

    2. Re:Patch not for Windows XP... by Anonymous Coward · · Score: 0

      Yeah, just use Edge on XP. Oh wait, those fuckers can't make a browser that's compatible with XP like Google and Mozilla can.

    3. Re:Patch not for Windows XP... by Anonymous Coward · · Score: 1

      Patch not for Windows XP...

      Because: fuck you, you are not paying us money.

      No one supports a particular version of a thing they made until the end of time, not even GNU/Linux distros. It's not some sort of M$ is teh evil situation.

  5. Yeah Well by Greyfox · · Score: 1, Troll
    Fortunately they'll be rid of it soon! Everyone will move to Windows 10 and their shiny new Edge browser, which I'm sure was created as a completely bug-free code-base with a fuck-ton of unit tests to prevent regressions!

    Ow. I think I hurt myself trying to make it through that post with a straight face.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  6. Who uses IE? by wnfJv8eC · · Score: 1

    Like the first program I remove is IE.

    1. Re:Who uses IE? by Dutch+Gun · · Score: 4, Informative

      It's what everyone uses for downloading Firefox or Chrome on a new Windows machine.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    2. Re:Who uses IE? by hcs_$reboot · · Score: 1

      It's what everyone uses for downloading Firefox or Chrome on a new Windows machine.

      Not everyone. I use a USB stick on which stands the latest Ubuntu release to add a Linux OS on the machine. This is yet another way to install Firefox, but at least it doesn't depend upon IE.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    3. Re:Who uses IE? by thegarbz · · Score: 1

      Look around you. If there are 8 people in the room then one of them is using IE. If your room is full of statistically representative samples of the internet.

      I congratulate you for not using IE. That doesn't mean there aren't literally millions of IE users out there.

    4. Re:Who uses IE? by Anonymous Coward · · Score: 0

      Like the first program I remove is IE.

      Is IE actually removable?

    5. Re:Who uses IE? by Anonymous Coward · · Score: 0

      Control Panel -> Uninstall a program -> Turn Windows features on or off -> [ ] Internet Explorer

    6. Re:Who uses IE? by Anonymous Coward · · Score: 0

      Not everyone. I switched to Windows 10 so I used Microsoft's latest better browser download tool call Edge.

    7. Re:Who uses IE? by Anonymous Coward · · Score: 0

      A lot of entrepises still uses IE because of their propriety app or website because its still not compatible with other browsers. Not even IE tab or other extentions on chrome is not enough some times. Those companies are putting their servers, apps and websites in danger inmho

    8. Re:Who uses IE? by Anonymous Coward · · Score: 0

      winkey+r

      iexplore www.google.com/chrome

    9. Re:Who uses IE? by antdude · · Score: 1

      Computer newbies, businesses, etc. :(

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  7. Out-of-band patch for iExplorer versions 11 by Anonymous Coward · · Score: 0

    "Microsoft has released an out-of-band patch for Internet Explorer versions seven to 11"

    Microsoft, the company that made web browsing dangerous ...

    1. Re:Out-of-band patch for iExplorer versions 11 by jones_supa · · Score: 1

      Wouldn't the sandbox mechanism protect the user in more recent versions of IE?

  8. IE is better than Firefox these days. by Anonymous Coward · · Score: 3, Informative

    As an early adopter of Firefox I hate to admit this, but modern versions of IE are now better than Firefox is.

    Earlier today we learned all about vulnerabilities in Pocket, which as you may recall is part of the unwanted functionality that Mozilla forced on Firefox users earlier this summer.

    At the end of last week we learned all about how Firefox makes unexpected HTTP requests when hovering over a link.

    Earlier this month there was a very serious bug that allowed web sites to access the files of Firefox users.

    Earlier this year we learned about ads built into Firefox.

    The worst part about all of those stories is that they're just from this summer, and they're just the ones that Slashdot has bothered to report on!

    1. Re:IE is better than Firefox these days. by Anonymous Coward · · Score: 0

      Yes, yes, mod me down, Slashdot. Enjoy your vapid misinformed circlejerk.

  9. For the love of... by Anonymous Coward · · Score: 1

    ...all that is unholy.

    " If the current user is logged on with administrative user rights , an attacker who successfully exploited this vulnerability could take complete control of an affected system."

    When is MicroSoft going to get off their butts and fix their operating systems so that the first user is not defaulted to administrator rights or at least have the first user forced to make a 'normal' user account for normal usage? Even 'ancient' Linuxs only add the first user to sudoers so that they have to explicitly invoke rootly powers.

    Windows will never be a reasonable operating system while MicroSoft panders to n00bs who don't know any better (and probably couldn't function) than to run with administrator access 24/7. How many of these problems could be mitigated if this were not MicroSoft's default approach?

    A vast majority of their userbase can't handle the 'administrator account is only to do administration and normal account is for everything else' paradigm. I was impressed that normal users had a sudo-like function of asking a normal user for the admin password if they try to do admin-like things, but hate that the default first user is still an administrator and leaves most n00b users open to these kinds of exploits.

    It doesn't seem all that hard to have the first user set an admin password but create a normal day-to-day account for general use.

    1. Re:For the love of... by benjymouse · · Score: 2, Insightful

      When is MicroSoft going to get off their butts and fix their operating systems so that the first user is not defaulted to administrator rights or at least have the first user forced to make a 'normal' user account for normal usage? Even 'ancient' Linuxs only add the first user to sudoers so that they have to explicitly invoke rootly powers.

      Unlike Linux, Windows uses proper security tokens. Each process has it's own token governing what it can do to which resources. On Linux the "token" is - rather naively - a user id.

      When you log on to Windows - since Vista - with an account with administrative rights, thee token that is created for the shell process is 1) stripped of all administrative rights and 2) given an integrity level of "normal". Integrity levels are also part of the token.

      What it means is that *even when you log on as an administrator* you do not possess any administrative or god-like rights. You are a standard user.

      When you invoke a program that has a manifest which states that it requires some form of administrative rights, Windows will prompt you for "elevated" privileges. Only when you accept to use your administrative privileges will the process be started with a token with higher than standard user rights.

      It really is a much more elegant solution than the stupid effective user in Linux, where the description of a process rights is strongly tied to a user: There must exist a user with the specific sets of rights you want the process to have. Not so on Windows: Any process can have it's own token with fewer or more rights/privileges.

      You can turn off UAC (don't!), which is why Microsoft must write the disclaimer *If the current user is logged on with administrative user rights*. If you turn off UAC and log in with an administrative account - then you run all processes with full permissions/privileges.

      When is MicroSoft going to get off their butts and fix their operating systems so that the first user is not defaulted to administrator rights or at least have the first user forced to make a 'normal' user account for normal usage?

      They did fix it. You are just ignorant.

      How many of these problems could be mitigated if this were not MicroSoft's default approach?

      The answer is 92% - and it is mitigated by default.

      --
      Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
    2. Re:For the love of... by gl4ss · · Score: 1

      funny thing is that malware never seems to have any trouble elevating the rights without asking the user, while for legitimate software the user gets bombarded with prompts.

      it's useless.

      just like on osx as well the separation is useless. malware finds a way around.

      --
      world was created 5 seconds before this post as it is.
    3. Re: For the love of... by cyber-vandal · · Score: 0

      Or it fails with the message "Something happened". Whoever thought that was an appropriate message should be beaten with a rubber hose.

    4. Re:For the love of... by cbhacking · · Score: 3, Interesting

      It actually goes a bit beyond this: even since Vista, IE has (by default) run with a *restricted* token that has even less privileges than the normal use. It is Low integrity level, meaning it can't interact with Medium integrity processes or write to most of the file system, registry, or other secured resources.

      Unfortunately, as Microsoft is wont to do, they fucked up the sandbox. The default configuration of IE only uses Protected Mode (Low IL) for the Internet and Restricted security zones. Notably, this excludes pages hosted on the local machine. Now, if you've got a code execution bug in IE, you can use that to run a webserver (on localhost). That webserver can host the exploit itself. Then you direct your hijacked, sandboxed IE to the localhost page, watch as the tab's process gets re-launched with normal privileges, and then you compromise that new process. You can protect yourself from this by going to Internet Options -> Security -> Local Intranet -> Enable Protected Mode.

      Similarly, the default "Don't notify me when I make changes to Windows settings" feature of UAC in Win7 (and above) is breakable; it's possible to get from medium IL to High IL (Administrator) if you have it enabled and are logged in as a member of the Administrators group. The fix is simple - just set it back to always prompting even for Windows settings (or do what I do, and have it actually ask for your password Sudo-style, though you need to use the Local Security Policy editor, secpol.msc, for that), or run as a non-member of Administrators - but most people never do any of these things.

      Microsoft is aware of both issues, and has issued no fixes for them. The POC program to silently elevate an arbitrary binary from Medium IL is blocked by Windows Defender (and probably other antivirus programs) but it would be easy enough to disguise it in such a way that the AV programs miss it.

      --
      There's no place I could be, since I've found Serenity...
    5. Re:For the love of... by Anonymous Coward · · Score: 0

      Sounds good in theory, but in reality, it has the same effect as the much more advanced permission system in Windows. In theory, access control lists allow you to specify exactly what permissions are needed, where as with the Unix permission system you need to (ab)use groups to do anything complex, and some combinations are basically not possible. But the result is that on Unix, permissions are set as needed, where as on Windows, you either hire a certified MS sysadmin, or everybody logs in as Administrator.

      UAC is the same, unless you have somebody who can set it up so that it works, it gets turned off. Which is harder in Windows 8, and even worse in 10, with the result that we have people at work running Visual Studio with "Run as administrator" and still having problems, where as on Windows 7 with UAC disabled and logged in as Administrator, it just works.

      Great in theory, but too complicated in reality.

    6. Re:For the love of... by Kjella · · Score: 1

      When you invoke a program that has a manifest which states that it requires some form of administrative rights, Windows will prompt you for "elevated" privileges. Only when you accept to use your administrative privileges will the process be started with a token with higher than standard user rights. It really is a much more elegant solution than the stupid effective user in Linux, where the description of a process rights is strongly tied to a user: There must exist a user with the specific sets of rights you want the process to have.

      It's possible they have more fine grained control behind the scenes but since the UAC prompt doesn't tell me anything I have to assume that any time I click yes that process can do anything, much like "sudo" on the Linux side. It might be ready for role-based security like on cell phones where they list the particular privileges the application wants, but I don't see it in practice.

      --
      Live today, because you never know what tomorrow brings
    7. Re:For the love of... by Anonymous Coward · · Score: 0

      Unlike Linux, Windows uses proper security tokens. Each process has it's own token governing what it can do to which resources. On Linux the "token" is - rather naively - a user id.

      http://www.extremetech.com/extreme/155392-international-space-station-switches-from-windows-to-linux-for-improved-reliability
      http://www.zdnet.com/article/linux-windows-and-security-fud/

      There must exist a user with the specific sets of rights you want the process to have.

      You high on drugs? http://www.linuxsecurity.com/docs/SecurityAdminGuide/SecurityAdminGuide-5.html

      Also, if any error occurs with any Linux, you just read the log. You use commands like more, less, cat. You use arrows.. page up.. page down.. home.. end.. search with / , name it. Easy peasy for reals.

      With Windows you open Event Viewer then get some really really retarded shit. No context menu, just ctrl-c available. Copy your error into buffer. Take your hex codes to Google (hopefully the error lets you go online) and then read Tech Net Indians years and years of cut/paste "solutions" for decades that may or may not have been answered, and may or may not have been the exact same hex error code for the same problem in Windows 98SE. Sure you can call Indian tech support. Good luck. Then if you find out it was due to an update... open up add/remove dumbfucks and locate the KB that you have to uninstall, reboot, check for updates again, find it again, then hide. Or of course find the registry location and click a bunch of +'s until you can add a parameter and set it to DWORD: 0. Or whatever the case may be.

      You can turn off UAC (don't!), which is why Microsoft must write the disclaimer *If the current user is logged on with administrative user rights*. If you turn off UAC and log in with an administrative account - then you run all processes with full permissions/privileges.

      This is not some brainstorm. eg. there it was in Vista. https://technet.microsoft.com/en-us/magazine/2007.09.securitywatch.aspx
      How to turn it off in the year 2006.

      weak. so weak. How many hacks and exploits and botnets on Windows just since 2006? You say "(don't!) .. gmab

      They did fix it. You are just ignorant.

      You called somebody else ignorant, yet everything you said comes across as blatantly dumb to me. I'd say inexperienced, but I can tell you looked at the subject matter so I conclude you are dumb.

      The answer is 92% - and it is mitigated by default.

      The actual answer is 100% you are dumb. You must be tripping on crack from the 80's if you think anybody on the face of the Earth will believe Windows is somehow smartly designed and secure. Internet Exploder? Ring any bells? Intertwined with the OS itself? Anti-trust ring any bells?

      At face value, staring at the architectures of Windows vs Linux/BSD/Mac... Windows stands out as OBVIOUSLY stupid. I use them all. I am partial to BSD's because FreeBSD was just so awesome and still is. Linux is just what everything runs on now. It has ease of use and so much software it'd make anybody new's head spin. For anybody with the baseline basic skill-set... like browse the web, email, social media, etc... Linux is just sweet. The latest KDE is sofa king cool.

      I agree with this article.
      https://www.linux.com/news/software/applications/810295-the-top-11-best-linux-distros-for-2015

      openSUSE and Debian are awesome. Choose the KDE desktop environment (default) and you are loving life. You can always add any of the other desktop environments and log in and out of them at any time, but KDE just takes the cake these days. It's fun to try the others too. You can make KDE behave like Mac's desktop environment too, but Iike KDE's default better.

      distrowatch.com .. nobody makes a cent off of you. It is all public gain. It is better than Windows in every way. The only thing that needs to catch up... is for game companies to compile their games to run on Linux more often. If all games ran on Linux, Windows is just some spyware junk you throw away.

    8. Re: For the love of... by tlhIngan · · Score: 1

      Whoever thought that was an appropriate message should be beaten with a rubber hose.

      Well, technically it's an unexpected error. Which happened because your locale was not set to "en-us" - everyone who saw it generally was outside the US - Australia (en-au), Canada (en-ca), etc. For whatever reason, the tool accesses something by the locale rather than language, so when it tried to find an en-ca or en-au or en-uk image, it fails. Given it's something that shouldn't ever fail, well...

    9. Re:For the love of... by Anonymous Coward · · Score: 0

      The "Don't notify me when I make changes to Windows settings" hole is unfixable so long as explorer can host plugins.

    10. Re:For the love of... by Anonymous Coward · · Score: 0

      Unlike Linux, Windows uses proper security tokens.

      You're an idiot.

      http://www.zdnet.com/article/windows-10-scam-email-will-encrypt-your-files-for-ransom/

      Windows is spyware from the day you install it by actual spies. Then the rookies pwn your shit later. Buy all your anti virus suites you want. Windows is a piece of shit and always was.

      distrowatch.com

  10. Re:NSA said it was okay to patch it. by Anonymous Coward · · Score: 0

    My guess is the NSA knew about it and just recently told MS it was okay to patch it.

    sure

    http://www.technobuffalo.com/2013/08/22/nsa-windows-8-exploit/
    http://www.technobuffalo.com/2013/07/11/microsoft-gave-the-nsa-direct-backdoor-access-to-outlook-skype/
    http://winsupersite.com/windows-10/how-stop-windows-10-upgrade-downloading-your-system
    http://www.extremetech.com/computing/195592-with-windows-10-microsoft-could-move-to-a-subscription-based-model
    http://www.extremetech.com/computing/205320-microsoft-windows-10-will-be-the-last-version-of-windows
    https://www.youtube.com/watch?v=5GU5uv28a3I
    http://techrights.org/2015/07/31/vista-10-anticompetitive/

    https://www.youtube.com/watch?v=wwRYyWn7BEo

    http://tech.slashdot.org/comments.pl?sid=7803015&cid=50272331

  11. Linux 101: Introduction to sudo .. by nickweller · · Score: 1

    @benjymouse: "When you invoke a program that has a manifest which states that it requires some form of administrative rights, Windows will prompt you for "elevated" privileges. Only when you accept to use your administrative privileges will the process be started with a token with higher than standard user rights. It really is a much more elegant solution than the stupid effective user in Linux."

    $su -c command ..

  12. Skip any browser done by Microsoft by Anonymous Coward · · Score: 0

    I think the clear answer here is skip any browser designed by Microsoft. It won't take long for the Edge browser to fall victim to the hackers. Right now its just not worth the trouble. Not enough people using it and its possible they never will given the dismal numbers coming from Windows 10 users. Maybe everyone has finally learned to stay away from Microsoft and browsers.