New IE zero-day vulnerability found

[nsane.forums]

Microsoft is investigating claims of a new zero-day vulnerability that leaves Internet Explorer browser users wide open to remote code execution attacks. Exploit code for the vulnerability has been added to the Metasploit tool and a video has been posted to provide a demo of the severity.

Here's a brief description of the issue from VUPEN:

A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to take complete control of a vulnerable system. This issue is caused by a use-after-free error within the "mshtml.dll" library when processing a web page referencing a CSS (Cascading Style Sheets) file that includes various "@import" rules, which could allow remote attackers to execute arbitrary code via a specially crafted web page.

VUPEN has confirmed this vulnerability with Microsoft Internet Explorer 8 on Windows 7, Windows Vista SP2 and Windows XP SP3, and with Internet Explorer 7 and 6 on Windows XP SP3.

Metasploit's exploit code provides some more information:

This module exploits a memory corruption vulnerability within Microsoft HTML engine (mshtml). When parsing an HTML page containing a recursive CSS import, a C++ object is deleted and later reused. This leads to arbitrary code execution.

According to the video posted by Abysssec Security Research, the exploit bypasses two key Windows anti-exploit mitigations (DEP and ASLR) without the use of any third party extensions.

There are reports that the vulnerability was first published on a Chinese security blog.

View: Original Article

[nsane.forums]

Microsoft Confirms Critical IE Bug, Works on Fix

Microsoft late Wednesday confirmed that all versions of Internet Explorer (IE) contain a critical vulnerability that attackers can exploit by persuading users to visit a rigged Web site. Although the company said it would patch the problem, it is not planning to rush out an emergency update.

"The issue does not currently meet the criteria for an out-of-band release," said Carlene Chmaj, a spokeswoman for the Microsoft Security Response Center (MSRC), in an entry on the center's blog. "However, we are monitoring the threat landscape very closely and if the situation changes, we will post updates."

Chmaj also downplayed the threat posed by the bug. "Currently the impact of this vulnerability is limited and we are not aware of any affected customers or active attacks targeting customers," she said.

The vulnerability in IE6, IE7 and IE8 surfaced several weeks ago when French security firm Vupen disclosed a flaw in IE's HTML engine. Tuesday, researchers posted a video demonstration of an attack, and added a reliable exploit to the Metasploit penetration toolkit.

That exploit used a technique revealed earlier this year by McAfee researchers that defeats a pair of important Windows defensive technologies -- ASLR (address space layout randomization) and DEP (data execution prevention) -- designed to stymie most attacks.

Illustration: Robert NeubeckerThe appearance of the Metasploit attack code may have been what prompted Microsoft to take action, as the company's more technical "Security Research & Defense" blog highlighted the Metasploit module.

In that blog, Microsoft security software engineer J. Serna also confirmed that IE's "mscorie.dll" file does not always automatically enable ASLR, a technology that randomly allocates executable memory to make it difficult for hackers to run their code.

Until a patch is ready, Microsoft urged users to use the Enhanced Mitigation Experience Toolkit (EMET) utility to bolster IE's defenses. The company provided instructions on how to configure EMET to block attacks in the accompanying security advisory .

EMET is a tool designed for advanced users, primarily enterprise IT pros, and manually enables ASLR and DEP for specific applications. It's often used to reinforce older programs.

Microsoft has recommended EMET before as a stop-gap defense. In September, it told users to configure it to block attacks then targeting users of Adobe Reader. But this is just the second time that Microsoft has suggested users roll out EMET to protect an up-to-date Microsoft program.

EMET 2.0 is a free download available from Microsoft's site.

Graphic: Diego AguirreUsers running IE7 or IE8 on Windows Vista and Windows 7 are less likely to be affected by a successful attack, Microsoft claimed, because those browsers include a feature called "Protected Mode" that prompts users before letting them install, run or modify certain operating system components.

Other browsers, including Firefox, Chrome, Safari and Opera, are not affected by the flaw.

The next regularly scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.

The last time the company issued an out-of-band update was late September when it patched a bug in the ASP.Net Web application framework.

View: Original Article