Security bods rip off Microsoft's 'sticking plaster' IE bug fix
Took them under 24 hours
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
A security researcher has developed a method to circumvent Microsoft's temporary fix for a zero-day Internet Explorer browser vulnerability.
Redmond release a temporary Fix It to defend against the flaw last week, pending the development of a more complete patch which it later emerged would not arrive with updates due to be delivered on Patch Tuesday tomorrow. However, Peter Vreugdenhil, of the vulnerability analysis firm Exodus Intelligence was able to sidestep that protection with a variation of a variation of a proof-of-concept exploit it developed to attack the IE bug.
"After less than a day of reverse-engineering, we found that we were able to bypass the fix and compromise a fully-patched system with a variation of the exploit we developed earlier this week," Vreugdenhil explained in a blog post.
The development will increase pressure for Redmond to develop a patch sooner rather than later. The vulnerability in older versions of Microsoft's browser software has been used to mount attacks on surfers visiting the Council for Foreign Relations website and other internet locations including Capstone Turbine, a US manufacturer of gas-powered micro-turbines. If security analysts at Exodus Intelligence can circumvent the fix then the implication is that cybercriminals might be able to do something similar, leaving the FixIt redundant. Exodus has reported its findings to Microsoft as well as making details of its discovery available to customers of its security feed.
The CVE-2012-4792 vulnerability affects IE6, IE7 and IE8 - obsolete but still widely used versions of Microsoft's web browser software browsers, released between 2006 and 2009. Both IE 9 and 10 are immune to attack, so upgrading or switching to alternative browser software is the best approach to take, especially for consumers. Enterprise workers may need older versions of IE to access (internal) intranet applications, hence the need to develop patches rather than simply encouraging everyone to upgrade. ®
COMMENTS
obsolete versions of IE
"obsolete but still widely used versions of Microsoft's web browser software browsers"
"ob·so·lete
/ˌäbsəˈlēt/
Adjective
No longer produced or used; out of date."
unfortunately all these versions of IE are still current and supported by Microsoft. IE8 certainly can't be called obsolete because it's the highest version available for XP and server 2003 both of which are widely used.
This is what happens when Microsoft would rather you upgrade your entire OS to get a newer version of the browser than release IE 9/10 for XP which is still in support until 2014. No wonder they lost market share to Firefox and Chrome, at least their latest versions still work on XP.
Re: Re: IE truly sucks
They can spend as much as they want on "security", but as long as they take the, "another layer of sticking plasters and it should hold" approach instead of developing a secure OS from the ground up, they're just pissing in the ocean.
(also, MS often don't hire decent people because windows is a sane devs nightmare)
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
