BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Internet Explorer 8 0day

Posted May 6, 2013    BeyondTrust Research Team

Last week, news broke that the U.S. Department of Labor’s (DoL) website was compromised… and that it had been serving up Internet Explorer 0day to its visitors. This 0day, CVE-2013-1347 (Retina Audit 19041 – Microsoft Internet Explorer 8 Remote Code Execution Vulnerability (Zero-Day)), only affects Internet Explorer 8 on Windows XP, Vista, and Windows 7 (as well as Server 2003, 2008, and 2008 R2). However, the exploit used on the U.S. Department of Labor website only targeted Windows XP machines. Here’s what else you need to know:

Metasploit module available, targeting Windows XP, Server 2003, Vista, and Windows 7 (PowerBroker Endpoint Protection Platform detects and defeats this module)

• Blocking/disabling Active Scripting in both Internet and intranet zones mitigates exploitation

• Highly likely this vulnerability will be used by exploit packs in the immediate future

• Vulnerability based on reliable use-after-free condition (mshtml!CGenericElement)

• Grants arbitrary code execution within the context of the currently logged on user (least privilege environment, anyone?)

So what can you do right now to protect your organization? If possible, use another browser like Chrome or Firefox, disable Active Scripting if you still have to use IE8, do not run as Administrator, and finally, upgrade – Internet Explorer 9 and 10 are not vulnerable to this issue.

Update 5-9-2013: Microsoft has released a Fix it for this 0day.

Tags:
, , , , , , ,

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

Tags:
, , , , ,
dave-shackleford-headshot

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

Tags:
, ,
patch-tuesday

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…

Tags:
,