Researchers by FireEye security company have identified a new zero-day exploit Internet Explorer in a hacked by clicking here.
This exploit targets English versions of Internet Explorer 7 and 8 in Windows XP and IE8 in Windows 7. OR FireEye says their analysis shows that vulnerability affects the versions of IE 7, 8, 9 and 10.
Η company ασφαλείας δεν ανέφερε αν ο IE10 για τα Windows 8 επηρεάζεται ή δοκίμασαν τον νέο browser IE11.
There are two vulnerabilities involved in the attack: the information disclosure vulnerability that the exploit uses to retrieve the timestamp from its PE headers msvcrt.dll (part of the Microsoft Visual C++ runtime). The second is an out-of-bounds memory access vulnerability, used to implementation code.
Many versions of msvcrt.dll are used for distribution, so exploit sends the timestamp back to the attacker's server, which returns a out-of-bounds exploit especially for the user's version.
The exploit includes a "ROP chain" according to FireEye. "ROP chain" means Address Space Layout Randomization (ASLR), a technique that is usually blocked by randomly setting the Address Space (ASLR) and has been around since Windows Vista.
FireEye is currently working with Microsoft to solve the problem. The report states that vulnerability can be mitigated by its use Enhanced Mitigation Experience Toolkit (EMET) 4.0, Microsoft's obvious emphasis on msvcrt.dll. Be careful as you may have copies of multiple versions of this DLL on your system.
