Zero-Day Flaws Found in Internet Explorer, Everyone Advised to Stop Using the Browser

[sinu]

Content source

http://news.softpedia.com/news/zero-day-flaws-found-in-internet-explorer-everyone-advised-to-stop-using-the-browser-487592.shtml

Internet Explorer will soon become the second option in Windows 10, but Microsoft is still struggling to keep it secure and patch all found vulnerabilities as fast as possible to make sure that users are perfectly secure.

But it turns out that this time the company hasn’t moved fast enough, as HP’s Zero-Day Initiative (ZDI) has just published four critical zero-day vulnerabilities (ZDI-15-359, 360, 361 and 362) it found in Internet Explorer after the 120-day policy was reached.

HP’s ZDI has a policy that stipulates that vendors who are informed about the found vulnerabilities are given 120 days to fix the flaws. If they fail to do so, the zero-days are posted online.

According to the information ZDI provided today, all vulnerabilities allow for remote code execution and attackers could get the same privileges as the logged-in users.

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit these vulnerabilities through Internet Explorer, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit these vulnerabilities,” ZDI says in an advisory.

“Refrain from using the browser”
What’s very important to know is that attackers need to convince you to click a malicious link, so unless you do that, you are perfectly secure. In some cases, however, they could turn to scripts and other tricks to make you click the link, so that’s why some security experts recommend you to stop using Internet Explorer for a while until Microsoft fixes this.

“It is unlikely that exploit code exists at the moment and difficult to reverse engineer the vulnerabilities as details are sparse. There is not much you can do at the moment, except refrain from using Internet Explorer,” Wolfgang Kandek, CTO of Qualys, said in a statement.

Internet Explorer is also available in Windows 10, which launches next week, so expect another out-of-band patch released by Microsoft in the coming days.

 

[Koroke San]

I thought IE is not included in window 10.

 

[Enju]

I thought IE is not included in window 10.

Windows 10 has IE and Edge installed.

 

[FleischmannTV]

These "stop using it" recommendations are so ridiculous. First of all, I am quite confident that MBAE and HitmanPro.Alert 3 will stop these *yet again* and you don't even need to spend any money in order to be protected, because the free version of MBAE already covers browsers. Secondly, when researchers discovered the Flash zero-days in February (I am not talking about the recent ones), they also advised to deactivate flash, but of course forgot to mention that this advice came three months too late, as the Hanjuan exploit kit had already been exploiting them since December.

 

[soccer97]

Here is a good question: If 4 zero days are found in IE, are some possibly exploitable in Microsoft as well. Doesn't office use some of the same files/libraries? I thought I may have read this somewhere, or correlated the two myself.

I wish there was a way to disable (not completely), but essentially turn IE off for these type of incidents, it could be a solution. I am relying on HitmanPro.Alert v3. Hopefully, it will catch and block them.


In KIS 2013/2014, if I am not mistaken, there was a way to harden IE. It was to set the homepage to about:blank (I believe this cleared the cache, and if IE crashed due to an exploit, it would not reopen the same tabs, nor keep them in memory to be exploited again when you reopen it?

Forgive my spelling, today has been a really rough day.

 

[Korora]

I never use Internet Explorer anyway, I keep it disabled because I always use Google Chrome or Opera and I'm tired of the amount of security risks IE offers.

 

[Cch123]

Here is a good question: If 4 zero days are found in IE, are some possibly exploitable in Microsoft as well. Doesn't office use some of the same files/libraries? I thought I may have read this somewhere, or correlated the two myself.

At least for the 4 ZDI advisories in the article, Office is not affected.

The article says: "According to the information ZDI provided today, all vulnerabilities allow for remote code execution and attackers could get the same privileges as the logged-in users." I don't know, but does anyone else find this sentence fishy? I think the writer has misunderstood ZDI. A remote code execution exploit only gives the attacker the same privilege as the process being attacked, not the logged in user. With IE's sandbox, it means the attacker can only run code at AppContainer priv level, which means the attacker cannot do pretty much anything without a second elevation exploit. So at the end of the day, it is not that serious to warrant a boycott, but nevertheless there are far better browsers, even from Microsoft itself (Edge).