UPDATE TO: Advanced Attackers Exploit IE 0day in the Wild

Severity: High

Summary:

• This vulnerability affects: All versions of Internet Explorer (IE)
• How an attacker exploits it: By enticing a user to visit web site containing malicious content
• Impact: An attacker can execute code with your privileges, potentially gaining complete control of your computer
• What to do: Install Microsoft’s emergency IE patch immediately, or let Windows Update do it for you

Exposure:

On Monday, we released an alert warning about a zero day vulnerability affecting all version of Internet Explorer. Researchers discovered attackers exploiting this critical flaw in the wild, and Microsoft had not yet released a patch at that time.

Today, Microsoft released an out-of-cycle security bulletin containing an update to fix this serious vulnerability. As mentioned in our original alert, IE suffers from something called a “use after free” memory corruption vulnerability. By enticing one of your users to a web site containing malicious content, an attacker can exploit this flaw to execute code on your machine, with your privileges. As usual, if you have local administrator privileges, the attacker gains full control of your machine.

Keep in mind, today’s attackers often hijack legitimate web pages and booby-trap them with malicious code. Typically, they do this via hosted web ads or through SQL injection and cross-site scripting (XSS) attacks. Even recognizable and authentic websites could pose a risk to your users if hijacked in this way, and the vulnerabilities described in today’s bulletin are perfect for use in drive-by download attacks. Furthermore, attackers are already exploiting this particular flaw in targeted attacks. We highly recommend you install Microsoft’s IE update immediately

We have included the original alert below for your convenience.

Solution Path:

Microsoft has released IE updates to correct this vulnerability. You should download, test, and deploy the updates immediately, or let Windows Update do it for you. You can find the updates in the “Affected and Non-Affected Software” section of Microsoft’s IE bulletin. Also note, Microsoft has included updates for Windows XP customers, despite their End-of-Life date last month.

If for some reason you cannot patch immediately, there are also some workarounds than can mitigate the issue. We detail those workarounds in our original alert, which we’ve included below for your convenience.

For All WatchGuard Users:

As mentioned in our original alert, there are a number of things WatchGuard XTM customers can do to protect themselves. For instance, you can use our proxy policies to block Flash content by extension (.SWF) or by MIME type (application/x-shockwave-flash). Furthermore, our IPS service includes signatures that block this IE exploit (update to signature set 4.410). Nonetheless, we still highly recommend you install Microsoft’s IE update to completely protect yourself from this attack.

Status:

Microsoft has released patches to fix this vulnerability.

References:

• MS Security Bulletin MS14-021

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).

Over the weekend, Microsoft released a critical security advisory warning customers of a serious new zero day vulnerability in Internet Explorer (IE), which attackers are exploiting in the wild. Around the same time, Kaspersky also noted an attack campaign leveraging a new Adobe Flash zero day flaw, which Adobe patched today. I’ll discuss both issues below, starting with the IE issue.

IE Zero Day in the Wild

According to this blog post, researchers at FireEye discovered advanced attackers exploiting this zero day IE flaw as part of a persistent attack campaign they are calling “Operation Clandestine Fox.” The attack targets IE 9-11 and also leverages a Flash flaw to help bypass some of Windows’ security features.

Shortly after FireEye’s post, Microsoft released a security advisory confirming the previously undiscovered flaw in IE. The advisory warns that the flaw affects all versions of IE (though the attack seems to target IE 9-11). While Microsoft is still researching the issue, the vulnerability seems to be a “use after free” class of memory corruption vulnerability. In short, if an attacker can entice you to a web page containing maliciously crafted content, he could exploit this flaw to execute code on your machine, with your privileges. As usual, if you have local administrator privileges, the attacker would gain full control of your machine. It’s interesting to note, the attackers also leverage a known Adobe Flash issue to help defeat some of Microsoft’s Windows memory protection features.

Zero day IE vulnerabilities are relatively rare, and very dangerous. Attackers are already exploiting this IE one in the wild, so it poses a significant risk. Unfortunately, Microsoft just learned of the flaw, so they haven’t had time to patch it yet. I suspect Microsoft will release an out-of-cycle patch for this flaw very shortly since this is a high-profile issue. In the meantime here a few workarounds to help mitigate the flaw:

• Temporarily use a different web browser – I’m typically not one to recommend one web browser over another, as far as security is concerned. They all have had vulnerabilities. However, this is a fairly serious issue.  So you may want to consider temporarily using a different browser until Microsoft patches.
• Install Microsoft EMET – EMET is an optional Microsoft tool that adds additional memory protections to Windows. I described EMET in a previous episode of WatchGuard Security Week in Review. Installing EMET could help protect your computer from many types of memory corruption flaws, including this one. This Microsoft blog post shares more details on how it can help with this issue.
• Configure Enhanced Security Configuration mode on Windows Servers – Windows Servers in Enhanced Security Configuration mode are not vulnerable to many browser-based attacks.
• Disable VML in IE – This exploit seems to rely on VML to work. Microsoft released a blog post detailing how disabling VML in IE, or running IE in “Enhanced Protection Mode” can help.
• Make sure your AV and IPS is up to date – While not all IPS and AV systems have signatures for all these attacks yet, they will in the coming days. In fact, WatchGuard’s IPS engineers have already created signatures to catch this attack. We are QA testing the signatures now, but they should be available to XTM devices shortly. Whatever IPS system you use, be sure to keep your AV and IPS systems updating regularly, to get the latest protections.
• WatchGuard XTM customers can block Flash with proxies – If you own a WatchGuard XTM security appliance, you can use our proxy policies to block certain content, including Flash content. For instance, you can use our SMTP or HTTP proxies to block SWF files by extensions (.SWF) or by MIME type (application/x-shockwave-flash). Keep in mind, blocking Flash blocks both legitimate and malicious content. So only implement this workaround if you are ok with your users not accessing normal Flash pages.

Adobe Patches Flash Zero Day

Coincidentally, Adobe also released an emergency Flash update today fixing a zero day exploit that other advanced attackers are also exploiting in a targeted watering hole campaign. The patch fixes a single vulnerability in the popular Flash media player, which attackers could exploit to run arbitrary code on your system; simply by enticing you to a web site containing specially crafted Flash content. This exploit was discovered in the wild by Kaspersky researchers (one of our security partners). According to Kaspersky’s research, the exploit was discovered on a Syrian website, and seems to be designed to target potential Syrian dissidents.

The good news is there is a patch for this flaw. So if you use Adobe Flash, go get the latest update now. By the way, some browsers like Chrome and IE 11 embed Flash directly, so you will also have to update those browsers individually. Finally, though the IE zero day I mentioned earlier does rely on a Flash issue, this particular zero day Flash flaw is totally unrelated. One additional note; WatchGuard’s IPS engineers have also created a signature for this exploit as well. It will be available shortly, once testing is complete.

So to summarize, if you use IE, disable VML, install EMET, and watch for an upcoming patch. If you use Flash, updates as soon as you can. I will be sure to inform you here, as soon as Microsoft releases their real patch or FixIt. — Corey Nachreiner, CISSP (@SecAdept)

Share This: