Late last week, Microsoft confirmed the existence of a new zero day vulnerability that affects all versions of Internet Explorer. As of 2013, Internet Explorer accounted for as much as 26% of the global browser market, which leaves a substantial percentage of the world’s computer users at risk. The vulnerability allows for remote code execution and can be used to force malicious code onto a targets system or gain complete control of a victim’s computer.
The vulnerability, which has been dubbed “Clandestine Fox” by the security firm that discovered it, has already been witnessed in targeted attacks against IE9, IE10 and IE11. However, given the nature of the exploit, it is only time before similar attacks are reported on older versions of Internet Explorer. Microsoft has issued a security advisory regarding the flaw, which it calls CVE-2014-1776:
The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
In short, a user doesn’t have to do anything specific to become infected by malware that makes use of this exploit. All a user would need to do is visit a compromised website and they would be put at risk.
Microsoft is currently investigating the issue and will likely release an out-of-band patch to solve the problem in the next couple days. However, this exploit is unique in that it is the first vulnerability to be discovered since the Windows XP end of the support date. What this means is that, while modern Windows operating systems will receive a patch to address this flaw, computers that still use Windows XP will remain vulnerable to the exploit. Given that almost 30% of Windows users still use the outdated operating system, we could see a huge influx of security breaches and IT disasters in the coming weeks.
If your business has been holding out for a reason to upgrade from Windows XP, now is the time.
– Richard Keene
IT Computer Support of New York
Webmaster and Lead Designer
