Microsoft patches critical IE 0-day used in watering hole attacks
Posted on 14 January 2013.
Microsoft has released an out-of-band patch for the Internet Explorer 0-day recently discovered to have been misused in a series of targeted watering hole attacks linked to the Elderwood gang.

The critical "CDwnBindInfo" use-after-free remote code execution vulnerability is present in Internet Explorer versions 6,7, and 8, and users of these are advised to update them as quickly as possible if they haven't got automatic updates enabled. Users of Windows Vista can also upgrade to IE 9 or 10, which are not impacted by the issue.

The security update addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory.

The bug, first spotted being misused to target visitors of the website of the Council on Foreign Relations, a think tank specializing in U.S. foreign policy and international affairs, has since been detected being used in attacks that compromised a number of other websites, including Chinese human rights sites and the site of Capstone Turbine Corp.

Microsoft has previously released a Fix It tool to temporarily protect users, but security firm Exodus Intelligence claimed it was flawed because it did not prevent all the paths an attacker can take to trigger or exploit the vulnerability.

They shared their findings and a working exploit with Microsoft, and refrained from publishing it until the vulnerability is patched.

Users who have applied the Fix It are advised to uninstall it once they apply the security update.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th