Attackers leverage new IE zero-day in 'Clandestine Fox' op
The zero-day exploit was already being used in targeted attacks, specifically aimed at IE 9 through IE 11.
A security firm warns that over a quarter of web browsers are likely vulnerable to zero-day attacks that take advantage of a recently discovered bug in Internet Explorer (IE).
Over the weekend, Microsoft alerted users that the vulnerability, affecting IE 6 through IE 11, had already been leveraged in “limited, targeted attacks,” against users. FireEye discovered the threat and disclosed information about the bug in a Saturday blog post, dubbing an ongoing campaign using the exploit, “Operation Clandestine Fox.”
FireEye noted that, in order to exploit the bug, an attacker would need to use an Adobe Flash exploitation technique, meaning the popular software would need to be enabled. Targeted attacks were specifically aimed at IE 9 through IE 11, the company said.
Microsoft has yet to release a patch for the issue, but the tech giant advised IE users to employ its Enhanced Mitigation Experience Toolkit (EMET) as a workaround for the issue, since the tool provides additional security layers that make the vulnerability harder to exploit, a Microsoft security advisory said.
The remote code execution vulnerability (CVE-2014-1776) “exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” the advisory said. “The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.”
To exploit the vulnerability, an attacker could convince a user to view a specially crafted website rigged to exploit the flaw, Microsoft said.
In its blog post, FireEye further warned that versions of IE vulnerable to the threat accounted for over 26 percent of the browser market last year, according to data available at NetMarket Share.