Fix It Issued for IE Zero Day

Thursday, February 20, 2014 @ 05:02 PM gHale


Microsoft issued a security advisory addressing the IE Zero Day exploited in attacks over the past few weeks, and has followed with a Fix it tool to temporarily mitigate the issue until a patch releases.

This Zero Day is a remote code execution vulnerability, which may corrupt memory and allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.

RELATED STORIES
IE Zero Day Part of Attack
Under Attack: XP Zero Day
Patch Tuesday Fixes Zero Day
Zero Day: Microsoft Under Attack

The vulnerability is easy to trigger, and requires the victims to simply visit a specially crafted website hosting the exploit, or websites that accept or host user-provided content or advertisements that could exploit the vulnerability.

The catch is only Internet Explorer 9 and Internet Explorer 10 suffer from the vulnerability, although the spotted attacks concentrated on compromising only IE 10 users.

IE versions 6, 7, 8 and 11 do not have the problem, and Microsoft has been advising users to protect themselves by upgrading to the latest version.

Those who can’t update, can download a Fix it or install the Enhanced Mitigation Experience Toolkit (EMET), as the exploit prevents itself from running if it detects EMET on the target computer.

“On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs,” the software giant said.



Leave a Reply

You must be logged in to post a comment.