Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Tuesday September 24 2019, @03:29AM   Printer-friendly
from the I'm-shocked,shocked-I-say dept.

Submitted via IRC for Bytram

Nine words to ruin your Monday: Emergency Internet Explorer patch amid in-the-wild attacks

Microsoft today issued a rare emergency security update for Internet Explorer to address a critical flaw in the browser that's being exploited right now in the wild.

Redmond says the vulnerability, a scripting-engine memory-corruption bug designated CVE-2019-1367, can be abused by a malicious webpage or email to achieved remote code execution: that means Windows PCs can be hijacked by viewing a suitably booby-trapped website, or message, when using Internet Explorer. Malware, spyware, and other software nasties can be injected to run on the computer, in that case.

Discovery of the flaw, and its exploitation in the wild by miscreants to commandeer systems, was attributed to Clément Lecigne of the Google Threat Analysis Group. The programming blunder is present in at least IE 9 to 11.

Such flaws are not uncommon, and Microsoft typically patches anywhere from 10-20 browser and scripting engine remote code execution each month with the Patch Tuesday bundle. Because they allow remote code execution with little or no user warning or interaction, Redmond considers such bugs to be critical security risks.

In this case, the severity of the flaw combined with the fact that vulnerability is being actively targeted has prompted Microsoft to break its normal patch cycle and release the update today, rather than wait until October 8 when the next Patch Tuesday drop is due to arrive.

[...] Microsoft also dropped a fix for a less-severe denial of service vulnerability in the Windows Defender security tool.

CVE-2019-1255 describes a file-handling error in Defender that will cause the security tool to generate a false positive when scanning an application. An attacker who already has access to the system could abuse the feature to make the tool block some applications.

"An attacker could exploit the vulnerability to prevent legitimate accounts from executing legitimate system binaries," Microsoft said.

Also at: https://arstechnica.com/information-technology/2019/09/microsoft-pushes-patch-of-ie-zeroday-thats-being-actively-exploited/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Interesting) by jmichaelhudsondotnet on Tuesday September 24 2019, @07:15AM (2 children)

    by jmichaelhudsondotnet (8122) on Tuesday September 24 2019, @07:15AM (#898003) Journal

    What if I told you pushing a forced update by surprise is also an attack on my system? Numerous accounts exist of these updates breaking random machines in impossible to predict ways, which has now become the cost of doing business with microsoft's borg-and-spy-oriented business model.

    Here is what is really happening: 'make intentional exploitable code error' -> 'exploit it for spying until someone who is not a spy discovers it' -> 'take credit for saving everybody from the bug' -> 'memory hole' -> 'rinse' -> 'are you in total control of the target countries yet?' -> 'if, yes, proceed to phase 2.' ->'if no, repeat until yes.'

    We are on like the 1001th iteration, so it's getting not only obvious to anyone with a memory longer than a hamster, but close to succeeding. Windows computers are not personal computers, I have also noticed the ransomware attacks are hitting also mostly windows tech. When you buy into a tech, you also buy into its vulnerabilities. Why anyone would think something like azure would be better when this it is run by spies out of a totalitarian country?

    This kind of incompetence and dishonesty has to be illegal somehow, or we should make it so, at this point it is a threat to civilization. A windows virus could end the world or allow a government to take total control, it's a single point of failure and permanent vulnerability. I am trying to think of a stupider thing humans do than use microsoft products but I am having a difficult time with that at the moment. It's really like watching a crowd of sleepwalkers or the footage of the nuremburg rally, how can people see how this is not going to end well? Microsoft at this point is more like a cult religion than a technology or company. At any rate, it is a huge chunk of the dominant cultural hegemony that is killing us all, so microshaft is a legitimate entity to fight. It's not the internet it's part of the global prison intercom system.

    thesesystemsarefailing.net
    globaldebate.net
    (this is a form of protest I will not stop until things at least stop deteriorating so rapidly)

    Starting Score:    1  point
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 2) by c0lo on Tuesday September 24 2019, @07:26AM

    by c0lo (156) Subscriber Badge on Tuesday September 24 2019, @07:26AM (#898004) Journal

    > Windows computers are not personal computers
    All my computers are personal computers.
    The ones I use with Windows? My employing company thinks it owns them (in any case, no IE on them anyway, the IT guys went with the Edge)

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
  • (Score: 1, Informative) by Anonymous Coward on Tuesday September 24 2019, @01:38PM

    by Anonymous Coward on Tuesday September 24 2019, @01:38PM (#898102)

    What if I told you pushing a forced update by surprise is also an attack on my system?

    What if I told you that installing Windows is an attack on your hardware.