-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Reference: CERT-EU Security Advisory 2013-0042 Title: Microsoft Internet Explorer 8 Security Advisory Version history: 03.05.2013 Initial publication Summary ======= Microsoft is investigating public reports of a vulnerability in Internet Explorer 8 [1]. Microsoft is aware of attacks that attempt to exploit this vulnerability. Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10 are not affected by the vulnerability. On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through monthly security update release process, or an out-of-cycle security update, depending on customer needs. Microsoft continues to encourage customers to follow the guidance in the Microsoft Safety & Security Center of enabling a firewall, applying all software updates, and installing antimalware software. CVE [2]: CVE-2013-1347 Affected Versions ================= Internet Explorer 8 Original Details ================ This is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. What can you do? ================ Apply Workarounds Workarounds refer to a setting or configuration change that does not correct the underlying issue but would help block known attack vectors before a security update is available. See the next section, Workarounds, for more information. Deploy the Enhanced Mitigation Experience Toolkit The Enhanced Mitigation Experience Toolkit (EMET) helps mitigate the exploitation of this vulnerability by adding additional protection layers that make the vulnerability harder to exploit. At this time, EMET is provided with limited support and is only available in the English language. For more information, see Microsoft Knowledge Base Article 2458544. For more information about configuring EMET, see the EMET User's Guide: On 32-bit systems the EMET User's Guide is located in C:\Program Files\EMET\EMET User's Guide.pdf On 64-bit systems the EMET User's Guide is located in C:\Program Files (x86)\EMET\EMET User's Guide.pdf Mitigating Factors ================== * By default, Internet Explorer on Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode that is known as Enhanced Security Configuration. This mode mitigates this vulnerability. * By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the Restricted sites zone. The Restricted sites zone, which disables script and ActiveX controls, helps reduce the risk of an attacker being able to use this vulnerability to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of this vulnerability through the web-based attack scenario. * An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. * In a web-based attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website. What to tell your users ======================= Normal security best practices apply. Especially, inform your Web users to be cautious about links to sites that are provided by unfamiliar or suspicious sources. Users are to be aware not to click on the link in suspicious emails; to immediately forward the suspicious email to the respective IT security officer / contact in your institution. More information ================ [1] http://technet.microsoft.com/en-us/security/advisory/2847140 [2] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1347 [3] http://support.microsoft.com/kb/2458544 Best regards, CERT-EU Team (http://cert.europa.eu) Phone: +32.2.2990005 / e-mail: cert-eu@ec.europa.eu PGP KeyID 0x46AC4383 FP: 9011 6BE9 D642 DD93 8348 DAFA 27A4 06CA 46AC 4383 Privacy Statement: http://cert.europa.eu/cert/plainedition/en/cert_privacy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJRh6kWAAoJEPpzpNLI8SVoWU8QAJ/NMfqIMxo6MyvKcIjj1cop d99EVxKDJnarohDD65nilYu1Sl7f9BJ8YhTQ962FwUnVVA5wlClzsgoMH2TVnQTf 0DdKmuhXibenc4O1Lik4C5KGMnYyClgKYqdQi5PBWlCgUvFauQytGnjYcaBluLG4 7afcHW7SsudSeQ534Yukpx1tdoZrssx/BApFeUCE+9fGNagsTdXFXLoPVi6+VbSA qTqkmPLj0r1vKEhOZc4LNvTOY/zSu6SB9CS2v+1tat+Gpk4Z0H35n9V4AyhJOHb2 neOxoe8v1XAqULDA//A2kSTmyqtKs4rPn1aRfKkg64D8Osk7Ikob5haGfaJwPvHl OAsLZwVLBAUHLKqqMLCv/xr4bObDAQpBmTQHDbUnYhgIxKbB1IVBRAi/fz+aJ71d 098fRCxJcTkOB7ey6SNg5b5Fk9J/BlQwPBh2gZJsRn9kujPLC8zyM4ABrbC+RCSj 7pQ3zBpRosfcH1yR7Om/iieOFSmGYAopM299mvw82BjKkxPtPc3Id1Asbr6NCMay CSOgDk6dxaVY8+qtYUkZ7Qy2X0EJp+7tHXeNJ8hl9rjiOHqP5fbTwtSePJJgo2WG jlmF40NFp17RkSmzBK77fOlNfwpwVjvfDNwiac5adckRTh2IN3RUrMjDJRIE/pQU 71oakdj5aJEvmNake4ME =kEJf -----END PGP SIGNATURE-----