Microsoft IE 0-Day Security Advisory (979352)

Microsoft is investigating new reports of a publicly exploited vulnerability in Internet Explorer.  Internet Explorer 6, 7, and 8 on XP, W2K3 Server, Vista, W2k8 Server, and Windows 7 are affected.  The vulnerability exists as an invalid pointer reference within IE.  The invalid pointer can be accessed after an object is deleted, causing IE to allow remote code execution.

Limited, active attacks attempting to use this vulnerability against Internet Explorer 6 have been observed in the wild.  Attacks against other versions of IE have not been seen in the wild so far.  On completion of their investigation, Microsoft will take the appropriate action to protect their customers, which may include providing a solution through the monthly security update release process, or an out-of-cycle security update.

Mitigating Factors:

•   An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In all cases, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.  In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability.
Protected Mode in Internet Explorer on Windows Vista and later Windows operating systems limits the impact of the vulnerability.
By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone.
By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e-mail messages in the Restricted sites zone. The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. However, if a user clicks a link in an e-mail message, the user could still be vulnerable to exploitation of this vulnerability through the Web-based attack scenario.

I highly recommend using a sandbox to surf the web, especially when things like this pop up on the security horizon.  Sandboxie is still free.  CWSandbox is a great commercial tool.

http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx

The Metasploit framework has added an exploit for this vulnerability.  Availability of this exploit increases the chance of in-the-wild exploitation of this issue.

http://blog.metasploit.com/2010/01/reproducing-aurora-ie-exploit.html

Advertisements