Microsoft IE Zero Day Gets Emergency Patch

Microsoft issued an out-of-band patch for a zero day bug in its Internet Explorer browser.

Microsoft patched a zero-day vulnerability in its Internet Explorer browser that is actively being exploited by attackers. The bug, reported by Google, is a remote code execution vulnerability that allowed attackers to infiltrate vulnerable systems via a booby trapped website that could have injected malicious code into the Internet Explorer browser.

“An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft wrote in an advisory posted Wednesday. “In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website, for example, by sending an email.”

The vulnerability (CVE-2018-8653) has been exploited in the wild, according to Satnam Narang, senior research engineer at Tenable. He said the bug allows an attacker to assume the privileges of the current Windows user and execute arbitrary code on the targeted system.

“If the current user has administrative rights on a system, an attacker can take control of the victim’s system to implant malware, modify data and add additional user accounts,” Narang wrote in an email.

Microsoft is urging customers to ensure that their Windows systems receive the Windows Update. Windows 10 users can also check for updates manually. Users of earlier versions of Windows can also check for updates here.

Since the vulnerability is actively being exploited in the wild, neither Microsoft or Google’s Threat Analysis Group has disclosed technical details tied to the IE zero-day vulnerability.

According to Microsoft, the remote code execution vulnerability exists because of the way affected versions of the IE browser’s scripting engine handles objects in memory. “The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user,” it said.

The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory, according to Microsoft.

Suggested articles

Discussion

  • Wally Thrasher on

    These securisecurity issues are not only in your browsers there are also many security issues with the gaming community cellular companies internet providers this has gotten out of hand. There's a lot of people who have the capabilities to monitor and control the traffic on their network and on the other hand the same tools that I use to control my network are the same tools that hackers use to control all of the other users networks most people are oblivious to the things that are going on in their own accounts. I have been coding and testing my own personal code and about the time I THINK I have gotten the hackers out of my stuff they get right back in it's like I'm fighting against a whole team of them and they gang bang me all at once. I'm about ready to shut down the whole web and start all over again. Make every user have an idea number and if they are caught coding anything wrong kick them off of the web forever. I can't enjoy my web experience for having to control my network redirecting my browser to where I want to go instead of where my neighbor wants me to go. And yes my neighbor is using Pretty.Fly.4.A.WiFi and a tp link console with toms hardware one source open wifi and running an ALTERNET out of Atlanta Georgia. Just saying nothing is sacred anymore.

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.