Microsoft Zero-Day Fix

Microsoft is warning customers to apply a temporary security fix to protect against a serious, newly discovered security flaw in the MHTML protocol for all supported versions of Windows.  The vulnerability results from the way Windows processes webpages containing MIME-formatted content, allowing attackers to run malicious scripts that spoof trusted websites, steal information, or carry out other unauthorized actions.

Microsoft’s security team “will take the appropriate action” once their investigation is complete.  A temporary “fix it” is being provided to prevent attacks by disabling some script execution and ActiveX functionality.  The security team is working with websites, including Google, to explore possible server-side fixes as well.

Microsoft’s advisory says there’s no evidence the flaw is being actively exploited in the wild, however PoC code is available.   Additional information here

Advertisements