Security Advisor

Glaring Omission in First Patch Tuesday of the Year

The recently discovered IE zero-day vulnerability has been overlooked by this month's Microsoft security update.

What's most interesting about January's Microsoft security update was not the two "critical" and five "important" fixes, but for what wasn't there -- an ironclad solution for a recently revealed Internet Explorer zero-day vulnerability.

The vulnerability, which was revealed by the Calif-based security firm FireEye in the last week of 2012, could allow anyone with the right know-how and loose moral fiber to hijack your system and insert malicious code due to how IE accesses deleted memory.

For those running the latest versions of IE, you're safe -- this issue only concerns IE 6,7 and 8.

Springing into action, Microsoft issued a security advisory on the flaw, which, while not providing a clear-cut solution, did offer a workaround in the form of a Microsoft Fix it.

The problem was that this workaround really didn't fix the issue, security firm Exodus Intelligence found:

"After posting our analysis of the current 0day in Internet Explorer which was used in a 'watering hole' style attack hosted on the Council for Foreign Relations Web site, we decided to take a look at the Fix It patch made available by Microsoft to address the vulnerability," the company said in a blog post. "After less than a day of reverse engineering, we found that we were able to bypass the fix and compromise a fully-patched system with a variation of the exploit we developed earlier this week."

The good news is that, while this zero-day vulnerability is a real threat, hackers have yet to start deploying attacks based on it.

Microsoft has yet to comment on why a bulletin wasn't able to be issued this past Tuesday, nor when a fix should be expected.

I'm hoping that Microsoft goes ahead and pushes out an out-of-band patch as soon as possible. Because a month is a long time to wait for a patch for such a serious issue and a long time to wait to hope that attackers won't start utilizing such a vulnerability.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

  • How To Improve Windows 10's Sound and Video Quality

    Windows 10 comes with built-in tools that can help users get the most out of their sound and video hardware.

  • Microsoft Offers More 'Solorigate' Advice Using Microsoft 365 Defender Tools

    Microsoft issued yet another article with advice on how to use its Microsoft 365 Defender suite of tools to protect against "Solorigate" advanced persistent threat types of attacks in a Thursday announcement.

comments powered by Disqus