Stories
Slash Boxes
Comments

SoylentNews is people

Microsoft Delivers Emergency Patch for Under-Attack IE

posted by Fnord666 on Thursday December 20 2018, @11:31AM   Printer-friendly
from the people-still-use-IE? dept.

upstart writes:

Submitted via IRC for Bytram

Microsoft delivers emergency patch for under-attack IE

Microsoft rarely mentions Internet Explorer (IE) anymore, but when it does, it usually means bad news.

So it was Wednesday, when Microsoft issued a rare emergency security update to plug a critical vulnerability in the still-supported IE9, IE10 and IE11. The flaw was reported to Microsoft by Google security engineer Clement Lecigne.

According to Microsoft, attackers are already exploiting the vulnerability, making it a classic "zero-day" bug. Because of that, the company released a fix before the next round of security updates scheduled for Jan. 8.

The update was issued to Windows 7, 8.1 and 10 - the latter with patches for versions 1607 and later - as well as Windows Server 2008, 2012, 2016 and 2019. (Updates for some versions of Windows 10 - 1607 and 1703 - were available only to Windows 10 Enterprise and Windows 10 Education.)

"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer," Microsoft stated in the CVE-2018-8653 support document. "The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user."

The vulnerability could be exploited simply by drawing users running IE9, IE10 or IE11 to a malicious website, perhaps with a phishing email.

[...] The IE security fix will be automatically offered, downloaded and installed on most unmanaged Windows PCs.

Original Submission

 
This discussion has been archived. No new comments can be posted.
Microsoft Delivers Emergency Patch for Under-Attack IE | Log In/Create an Account | Top | 9 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 3, Informative) by ElizabethGreene on Thursday December 20 2018, @06:13PM (2 children)

    by ElizabethGreene (6748) Subscriber Badge on Thursday December 20 2018, @06:13PM (#776883) Journal

    Are we talking JavaScript here? (or ECMAscript or M$ bastard JScript)

    Yes and no. The effected binary is Jscript.dll which is not the default javascript engine in IE 10 and 11. The default engine in those is Jscript9.dll. The old engine can be used by a modern browser under certain circumstances.

    I assume those circumstances include explicitly asking for it and/or compatibility rendering scenarios, but I haven't been able to demonstrate that to my satisfaction yet.

    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   3  

  • (Score: 3, Funny) by ElizabethGreene on Friday December 21 2018, @12:24AM (1 child)

    by ElizabethGreene (6748) Subscriber Badge on Friday December 21 2018, @12:24AM (#777023) Journal

    Apologies for failing to mention this earlier; I'm a Microsoft Platforms PFE supporting enterprise customers.

    • Please don't hold that against me.
    • Yes I know that makes my opinion invalid.
    • The only extinguishing I'll be doing is if one of us is on fire.

    • (Score: 0) by Anonymous Coward on Friday December 21 2018, @09:35AM

      by Anonymous Coward on Friday December 21 2018, @09:35AM (#777149)

      Thanks for the useful insider reply and sorry to hear of your predicament.