[Owasp-Recife] Active 0day attack hijacking IE users threatens a quarter of browser market

Caio Dias caio.dias at owasp.org
Mon Apr 28 12:31:22 UTC 2014


Attackers are actively exploiting a previously unknown vulnerability in all
supported versions of Internet Explorer that allows them to surreptitiously
hijack vulnerable computers, Microsoft warned Sunday.

The zero-day code-execution hole in IE versions 6 through 11 represents a
significant threat to the Internet security because there is currently no
fix for the underlying bug, which affects an estimated 26 percent of the
total browser market. It's also the first significant vulnerability to
target Windows XP users since Microsoft withdrew support for that
aging OS<http://arstechnica.com/information-technology/2014/04/xpocalypse-now-windows-xp-support-has-ended/>earlier
this month. Users who have the option of using an alternate browser
should avoid all use of IE for the time being. Those who remain dependent
on the Microsoft browser should immediately install
EMET<http://support.microsoft.com/kb/2458544>,
Microsoft's freely available toolkit that greatly extends the security of
Windows systems.

The vulnerability is formally indexed as
CVE-2014-1776<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1776>.
Microsoft has blog posts
here<https://technet.microsoft.com/en-us/library/security/2963983>,
here<http://blogs.technet.com/b/msrc/archive/2014/04/26/microsoft-releases-security-advisory.aspx>,
and here<http://blogs.technet.com/b/srd/archive/2014/04/26/more-details-about-security-advisory-2963983-ie-0day.aspx>that
lay out bare bones details uncovered at this early stage in its
investigation. Although there is no exploited vulnerability in Adobe Flash,
disabling the browser add-on will also neutralize attacks, analysts at
security firm FireEye Research Labs wrote in a separate blog
post<http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html>published
Sunday. Disabling vector markup language support in IE also
mitigates attacks.

Fonte:
http://arstechnica.com/security/2014/04/active-0day-attack-hijacking-ie-users-threatens-a-quarter-of-browser-market/


-- 
Caio Dias
<https://about.me/caiodias>https://about.me/caiodias
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.owasp.org/pipermail/owasp-recife/attachments/20140428/5f57e539/attachment.html>


More information about the Owasp-recife mailing list