In a announcement, Microsoft announced that the very popular 0-day flaw that is being used to promote drive-by attacks will be patched on Microsoft’s Patch Tuesday. The update is a quick fix for Internet Explorer, and is a widely reported bug that Microsoft is getting ahead of quickly.
The announcement to fix this bug and security flaw came as the flaw was announced last Thursday. The security firm FireEye discovered the flaw on November 8th, and word spread quickly within the security world about the Internet Explorer flaw, but Microsoft is fixing it.
What It Is
The 0-day flaw in Internet Explorer was developed to inject malware into the browser of anyone who visited a malicious website. The exploit as described by many in the security industry exploits leverages about a new vulnerability in Internet Explorer, and essentially runs it out of memory to inject the malware into the users computer.
The exploit in Internet Explorer exploits the DLL file within Internet Explorer, runs it with code that overflows the memory, and then launches an EXE file to unjust the code. The data isn’t written to a file, and is aimed to infect users computers with malware that they will then overflow the computer with malware. It’s a particularly nasty malware and one that was fixed quickly.
Microsoft announced today that they saw this bug and exploit, and that this Bulletin 3 bug will be addressed at 10:00 AM PDT in the patch Tuesday fix. The automatic updates will be able to download the fix and update Internet Explorer right away. Microsoft is finalizing the security update currently and are in the process of getting it out within 24 hours.
Microsoft is recommending users put their Internet and local intranet security zone settings to “HIGH” to block ActiveX controls and Active Scripting in these zones. Users are also advised to configure Internet Explorer to prompt before running Active Scripting or disable Active Scripting in the Internet and local intranet security zones. All of this should be fixed and addressed soon.
I think Microsoft jumping on this is crucial. It’s a major bug, and one that Microsoft fixed quickly. Hopefully it hasn’t affected many people.