Microsoft issues temporary fix for zero-day IE vulnerability

Share this article:

Microsoft has released a workaround for a zero-day vulnerability affecting versions 6, 7 and 8 of Internet Explorer.

The flaw became known when it was used as part of a so-called "watering hole" attack against the website for the policy think tank Council on Foreign Relations, the influential membership group that helps shape U.S. foreign policy.

About two weeks ago, the site was hijacked with malicious JavaScript to serve an Adobe Flash exploit, which in turn triggered a heap-spray attack, according to researchers at security firm FireEye. The malware was delivered to users whose operating system language was set to English, Chinese, Japanese, Korean or Russian.

Microsoft on Saturday acknowledged in an advisory that the vulnerability has been used in a limited number of targeted attacks. At least one other organization, Chatsworth, Calif.-based microturbine systems supplier Capstone Turbine Corp., had its website compromised to take advantage of the bug, security researcher Eric Romang said Wednesday in a blog post.

On Monday, Microsoft released a Fix-It tool, which, if applied, "prevents the vulnerability from being used for code execution without affecting your ability to browse the web," Dustin Childs, group manager of response communications for Microsoft Trustworthy Computing, wrote in a blog post. Users also can upgrade to IE 9 or 10, which are not affected by the issue.

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.