Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Wednesday January 22 2020, @09:50AM   Printer-friendly

An unpatched remote code-execution vulnerability in Internet Explorer is being actively exploited in the wild, Microsoft has announced. It's working on a patch. In the meantime, workarounds are available.

The bug (CVE-2020-0674) which is listed as critical in severity for IE 11, and moderate for IE 9 and IE 10, exists in the way that the jscript.dll scripting engine handles objects in memory in the browser, according to Microsoft's advisory, issued Friday.

The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user – meaning that an adversary could gain the same user rights as the current user.

"If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system," Microsoft explained. "An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

An attack could be carried out using a malicious website designed to exploit the vulnerability through IE, the advisory noted. Threat actors could lure victims to the site by sending an email, through watering-hole techniques, via malicious documents containing a web link and other social-engineering efforts.

There is a workaround available from Microsoft, as well as a micropatch from 0patch, released on Tuesday.

Story: https://threatpost.com/microsoft-zero-day-actively-exploited-patch/152018/


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 3, Insightful) by darkfeline on Wednesday January 22 2020, @11:39AM (3 children)

    by darkfeline (1030) on Wednesday January 22 2020, @11:39AM (#946785) Homepage

    Obviously, workarounds are available; don't use Internet Explorer.

    I'm not even being facetious, why is Microsoft suggesting other workarounds? This is like if you had a car that had a flaw that made it randomly explode. You wouldn't apply a workaround fix to the car, you would just drive another car.

    --
    Join the SDF Public Access UNIX System today!
    • (Score: 0) by Anonymous Coward on Wednesday January 22 2020, @01:15PM (2 children)

      by Anonymous Coward on Wednesday January 22 2020, @01:15PM (#946809)

      > This is like if you had a car that had a flaw that made it randomly explode.

      No it isn't. In fact, it is nothing like a car with a flaw that made it randomly explode.

      • (Score: 5, Funny) by ikanreed on Wednesday January 22 2020, @02:55PM (1 child)

        by ikanreed (3164) Subscriber Badge on Wednesday January 22 2020, @02:55PM (#946833) Journal

        Yeah, it's more like driving a car where you know for sure it's going to explode today.

        • (Score: 0) by Anonymous Coward on Wednesday January 22 2020, @05:18PM

          by Anonymous Coward on Wednesday January 22 2020, @05:18PM (#946899)

          Explode is one of many, but the closest analogy is the hacker can hop in and drive your car away at anytime. So it really is just that the door locks are now found to be unlockable.

  • (Score: 3, Funny) by KritonK on Wednesday January 22 2020, @12:25PM (1 child)

    by KritonK (465) on Wednesday January 22 2020, @12:25PM (#946791)

    critical in severity for IE 11, and moderate for IE 9 and IE 10

    I'm using IE 8, so I'm safe!

    • (Score: 0) by Anonymous Coward on Wednesday January 22 2020, @12:53PM

      by Anonymous Coward on Wednesday January 22 2020, @12:53PM (#946803)

      I'm using IE 5, so I'm safer than you.

  • (Score: 2) by stormreaver on Wednesday January 22 2020, @12:38PM

    by stormreaver (5101) on Wednesday January 22 2020, @12:38PM (#946799)

    So in other words, this is Microsoft software working as designed.

(1)