Feeds

Microsoft plasters IE8 hole abused in nuke lab PC meltdown

Security stopgap follows shock US boffinry attack

Next gen security for virtualised datacentres

Microsoft has issued a temporary fix for a high-profile Internet Explorer 8 vulnerability. This is the bug linked to recent targeted attacks against web pages accessed by nuclear weapons research teams at the US Department of Labor website.

The Fix It, released late on Wednesday, is designed to offer a temporary block against attacks based on the zero-day vulnerability ahead of a more comprehensive patch.

Applying the Fix will not require a reboot, a important factor in corporate environments. Microsoft is withholding details on what the Fix It actually does - at least until after its security gnomes forge a proper patch.

Redmond recommends that all customers using Internet Explorer 8 apply the stop-gap Fix It. Users of other versions of Internet Explorer are not affected and therefore need not worry.

"We have updated Security Advisory 2847140 with an easy one-click Fix It to help protect Internet Explorer 8 customers," said Dustin Childs, group manager of response communications at Microsoft Trustworthy Computing in a statement.

"Customers should apply the Fix It or follow the workarounds listed in the advisory to help protect against the known attacks while we continue working on a security update. Internet Explorer 6, 7, 9 and 10 are not affected."

The Fix It is an easy-to-apply alternative to various workarounds detailed by Microsoft when it admitted there was a serious hole in its browser software late last week. Part of these defences rely on using Microsoft’s free Enhanced Mitigation Experience Toolkit (EMET), which offers added protection against 0-days targeted at browsers on Windows systems that specifically tackle memory corruption-related security bugs.

IE 8 comes pre-installed on Windows 7 systems but users have the straightforward option of upgrading to IE 9 in order to stay out of harm's way, an option unavailable to laggards running Windows XP boxes.

A blog post by Wolfgang Kandek, CTO at cloud security firm Qualys, commenting on the vulnerability and suggested defence tactics can be found here.

Stats from Qualys's BrowserCheck service suggest that 42 per cent of all systems are running IE 8. If successfully exploited, the 0-day vulnerability (CVE-2013-1347) in IE 8 yields full control of compromised Windows machines, allowing hackers to install malware such as the Poison Ivy Trojan.

The exploit has reared its ugly head on several other websites since its initial discovery on a US Department of Labor website on 1 May. Since then the exploit has also been bundled into Metasploit, the popular open-source penetration testing toolkit. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.