Security Advisor

Glaring Omission in First Patch Tuesday of the Year

The recently discovered IE zero-day vulnerability has been overlooked by this month's Microsoft security update.

What's most interesting about January's Microsoft security update was not the two "critical" and five "important" fixes, but for what wasn't there -- an ironclad solution for a recently revealed Internet Explorer zero-day vulnerability.

The vulnerability, which was revealed by the Calif-based security firm FireEye in the last week of 2012, could allow anyone with the right know-how and loose moral fiber to hijack your system and insert malicious code due to how IE accesses deleted memory.

For those running the latest versions of IE, you're safe -- this issue only concerns IE 6,7 and 8.

Springing into action, Microsoft issued a security advisory on the flaw, which, while not providing a clear-cut solution, did offer a workaround in the form of a Microsoft Fix it.

The problem was that this workaround really didn't fix the issue, security firm Exodus Intelligence found:

"After posting our analysis of the current 0day in Internet Explorer which was used in a 'watering hole' style attack hosted on the Council for Foreign Relations Web site, we decided to take a look at the Fix It patch made available by Microsoft to address the vulnerability," the company said in a blog post. "After less than a day of reverse engineering, we found that we were able to bypass the fix and compromise a fully-patched system with a variation of the exploit we developed earlier this week."

The good news is that, while this zero-day vulnerability is a real threat, hackers have yet to start deploying attacks based on it.

Microsoft has yet to comment on why a bulletin wasn't able to be issued this past Tuesday, nor when a fix should be expected.

I'm hoping that Microsoft goes ahead and pushes out an out-of-band patch as soon as possible. Because a month is a long time to wait for a patch for such a serious issue and a long time to wait to hope that attackers won't start utilizing such a vulnerability.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Offers More Help on Windows Server 2008 Upgrades

    Microsoft this week published additional help resources for organizations stuck on Windows Server 2008, which fell out of support on Jan. 14.

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

  • First Stable Chromium-Based Microsoft Edge Browser Released

    Microsoft on Wednesday announced the first release of its Chromium-based Microsoft Edge browser at the "stable" commercial-release stage.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.