Microsoft patches critical IE 0-day used in watering hole attacks
Posted on 14 January 2013.
Microsoft has released an out-of-band patch for the Internet Explorer 0-day recently discovered to have been misused in a series of targeted watering hole attacks linked to the Elderwood gang.

The critical "CDwnBindInfo" use-after-free remote code execution vulnerability is present in Internet Explorer versions 6,7, and 8, and users of these are advised to update them as quickly as possible if they haven't got automatic updates enabled. Users of Windows Vista can also upgrade to IE 9 or 10, which are not impacted by the issue.

The security update addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory.

The bug, first spotted being misused to target visitors of the website of the Council on Foreign Relations, a think tank specializing in U.S. foreign policy and international affairs, has since been detected being used in attacks that compromised a number of other websites, including Chinese human rights sites and the site of Capstone Turbine Corp.

Microsoft has previously released a Fix It tool to temporarily protect users, but security firm Exodus Intelligence claimed it was flawed because it did not prevent all the paths an attacker can take to trigger or exploit the vulnerability.

They shared their findings and a working exploit with Microsoft, and refrained from publishing it until the vulnerability is patched.

Users who have applied the Fix It are advised to uninstall it once they apply the security update.


Biggest ever cyber security exercise in Europe is underway

Posted on 30 October 2014.  |  More than 200 organisations and 400 cyber-security professionals from 29 European countries are testing their readiness to counter cyber-attacks in a day-long simulation, organised by the European Network and Information Security Agency (ENISA).

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.


Thu, Oct 30th