Slashdot Mirror
Microsoft Issues Emergency Fix For Internet Explorer Zero Day (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: Microsoft has released an out-of-band security update that fixes an actively exploited vulnerability in Internet Explorer. This vulnerability has been assigned ID CVE-2018-8653 and was discovered by Google's Threat Analysis Group when they saw the vulnerability being used in targeted attacks. According to Microsoft's security bulletin this is vulnerability in how the Internet Explorer scripting engine handles objects in memory. Attackers can use this vulnerability to corrupt memory in such a way that attackers could execute code under the security privileges of the logged in user. This vulnerability can also be used to launch attacks through specially crafted web sites that utilize the exploit code. This means that attackers can utilize this feature in exploit kits or by compromising legitimate sites and adding code that exploits the vulnerability.
"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer," states Microsoft's advisory. "The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."
"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer," states Microsoft's advisory. "The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."
This is why I use Microsoft on all non-web mission-critical facilities. Guaranteed security. Linux can't match and never will thanks to Linus. Great for my hobbyist machines tho.
It's become obvious that JIT is a persistent threat that cannot reliably be tamed. If browser makes actually cared about security that would at least make it an option to disable JIT and use an interpreter in it's place. Sadly, it's the browser wars have become a race to see who can run the most garbage scripts as fast as possible and damn the consequences.
Anons need not reply. Questions end with a question mark.
And use remote code execution to set Firefox as default browser.
...this news came out two days ago.
And slashdot will probably have a dupe in 3 days time.
Slashdot used to be a good source for tech news.
Sigh.
i tought this was abandonware :)
Microsoft still has internet explorer? Does anybody else?
If it is not an exploit discovered on the first day of release, it is not a zero day.
Why are Microsoft still releasing patches for Internet Explorer? Didn't it get replaced by Edge years ago?
#DeleteFacebook
Couldn't they just email the fix to the remaining two non-corporate users?
Who knows what the author thinks a zero-day means, but it's wrong.
A zero day means "The software company has known about it for zero days." There won't be many defenses against it, because it's been known about for zero days. In this case, Microsoft has known about it for a few days at least, and there is a patch available. So it is a 10 day exploit, or 15 day exploit.
"First they came for the slanderers and i said nothing."
I kinda wish they left it unpatched. Let it die already.