Internet Explorer Security Vulnerability: Fixed

[David Baxter PhD]

German watchdog warns of Internet Explorer security breach
CBC
September 18, 2012

Code said to attack Windows XP or Windows 7 operating systems

The German government agency overseeing IT-safety is warning of a security breach in Microsoft's Internet Explorer and recommending people use other browsers until the problem is fixed.

The Federal Office for Information Security said in a statement late Monday the browser's "weak point is already being used for targeted attacks."

It warns the code to attack computers running on Windows XP or Windows 7 operating systems through the browser is freely available online and might therefore spread rapidly.

The agency says users of Internet Explorer versions 7, 8 or 9 should switch to alternative browsers until Microsoft updates its browser's security features.

Microsoft Corp.'s German division was not immediately reachable for comment Tuesday morning.

 

[David Baxter PhD]

Microsoft Security Advisory (2757760)

Microsoft Security Advisory (2757760)
Microsoft
Monday, September 17, 2012

Vulnerability in Internet Explorer Could Allow Remote Code Execution
Version: 1.0

General Information
Microsoft is investigating public reports of a vulnerability in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9. Internet Explorer 10 is not affected. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability.

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.

We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. In addition, we are actively working with partners to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability.

Microsoft continues to encourage customers to follow the guidance in the Microsoft Safety & Security Center of enabling a firewall, applying all software updates and installing anti-virus and anti-spyware software.

Mitigating Factors:

• By default, Internet Explorer on Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode that is known as Enhanced Security Configuration. This mode mitigates this vulnerability.
• By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the Restricted sites zone. The Restricted sites zone, which disables script and ActiveX controls, helps reduce the risk of an attacker being able to use this vulnerability to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of this vulnerability through the web-based attack scenario.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
• In a web-based attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.

Recommendation.
See the Suggested Actions section of this advisory for more information.

 

[David Baxter PhD]

Microsoft Update
September 21, 2012

Microsoft has completed the investigation into public reports of this vulnerability. We have issued MS12-063 to address this issue. For more information about this issue, including download links for an available security update, please review MS12-063. The vulnerability addressed is the execCommand Use After Free Vulnerability - CVE-2012-4969.

 

[David Baxter PhD]

Re: Microsoft Security Advisory (2757760)

MS12-063: Cumulative Security Update for Internet Explorer: September 21, 2012
Article ID: 2744842 - View products that this article applies to.

INTRODUCTION
Microsoft has released security bulletin MS12-063. To view the complete security bulletin, visit one of the following Microsoft websites:

Home users: http://www.microsoft.com/security/pc-security/bulletins/201210.aspx

Skip the details: Download the updates for your home computer or laptop from the Microsoft Update website now: http://update.microsoft.com/microsoftupdate/

 

[David Baxter PhD]

IE 9.0.10 Available via Windows Update
by Tyson Storey, Program Manager, Internet Explorer
September 21, 2012

Today we released Security Update MS12-063 to address limited attacks against a small number of computers through a vulnerability in Internet Explorer versions 9 and earlier.

We also released an update that addresses vulnerabilities in Adobe Flash Player in Internet Explorer 10 on Windows 8. The majority of customers have automatic updates enabled and will not need to take any action because protections will be downloaded and installed automatically. For those manually updating, we encourage you to apply this update as quickly as possible.

Microsoft Security Bulletin MS12-063
This security update resolves one publicly disclosed and four privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows servers. Internet Explorer 10 is not affected. For more information about the vulnerabilities, see the full bulletin. This security update also addresses the vulnerability first described in Microsoft Security Advisory 2757760.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871. For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

Microsoft Security Advisory (2755801)
Microsoft is announcing the availability of an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and Windows Server 2012. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10. For more information, see the advisory.