Internet Explorer zero day found

Powered by SC Magazine
 

Internet Explorer 10 safe.

Updated: A zero day vulnerability has been discovered that targets Microsoft Internet Explorer and is under active attack.

The exploit was found by researcher Eric Romang on public servers operated by perpetrators behind the Chinese Nitro attacks last year that targeted the chemical industry. 

It works by dropping the file exploit.html which creates an .img and .swf file which Internet Explorer handles as Flash.

The exploit does not affect version 10 of Internet Explorer, the upcoming version of the browser which was open for testing. It works on all Microsoft operating systems.

Microsoft recommended users block ActiveX.

"Set internet and local intranet security zone settings to 'high' to block ActiveX Controls and Active Scripting in these zones," Trustworthy Computing director Yunsun Wee said in a blog post.

"Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones."

These mitigations would prevent exploitation but could affect usability. Wee said trusted sites should be added to the IE Trusted Sites zone to minimise disruption.

The exploit was quickly added to Rapid 7’s penetration testing framework Metasploit. Developers there worked with contributor Romang to understand the exploit.

The vulnerable version 9 of Internet Explorer was the dominant browser in Australia, according to StatCounter, with about a quarter of users running the software.

Metasploit developer Sinn3r posted screenshots of the exploit in action.

 

Credit: Rapid 7

Copyright © SC Magazine, Australia


Internet Explorer zero day found
 
 
 
Top Stories
Can the ATO use IT to shed its old-school reputation?
Inside the ‘reinvention’ at the hands of new management.
 
JB Hi-Fi's new CIO gets 'clean slate' for change
New AusPost, Tabcorp exec to get his hands dirty.
 
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Xero updates Android app
Aug 5, 2015
A new Android version of Xero Touch - the mobile companion app for the Xero cloud accounting ...
The 5 Windows 10 privacy issues you should be aware of
Jul 31, 2015
There are a few unsettling details when it comes to Windows 10 privacy
Windows 10 is here! (For some)
Jul 29, 2015
Delivery of the free upgrade versions of Windows 10 began today - have you got yours yet?
Microsoft reveals Microsoft Send, a new enterprise chat app to rival Slack
Jul 27, 2015
Microsoft Send is MSN Messenger for grownups, and you could be using it at work very soon
Developers offered $500,000 grants to find HoloLens uses
Jul 8, 2015
Can augmented-reality end up in business?
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  14%
 
No
  51%
 
Only in special circumstances
  18%
 
Yes, but with more transparency
  18%
TOTAL VOTES: 837

Vote