Feeling twitchy about nasty IE 0-day? Microsoft promises relief today
An unpatched flaw in Internet Explorer that become the topic of a high-profile warning over the weekend will be patched later on Tuesday, Microsoft promises.
The CVE-2013-3918 vulnerability, affecting an Internet Explorer ActiveX Control, shipped up in active attacks detected by net security firm FireEye, sparking a high-profile warning.
The flaw has already been abused in a variety of attacks by a group linked to the Operation DeputyDog assaults against targets in Japan and China.
However by a happy coincidence Redmond already has the latest IE issue in hand and plans to release a fix as part of a cumulative update to IE (bulletin MS13-090) already scheduled as part of the November edition of Patch Tuesday.
The vulnerability exists in various versions of Internet Explorer 7, 8, 9 and 10, running Windows XP or Windows 7.
Sysadmins concerned about protecting against the vulnerability pending their ability to deploy the critical fix are advised to follow workarounds detailed in a security advisory by Microsoft’s Security Response Team that involves either blocking ActiveX Controls and Active Scripting or rehiring user prompts before running the technology. Even Microsoft admits these workarounds might cause usability problems.
Microsoft is lining up eight bulletins for the November edition of Patch Tuesday, including three critical fixes. However there’s no relief in sight for a separate zero-day vulnerability involving how Office handles .TIFF graphics files. The flaw is being actively exploited in attacks, predominately in India and China, by both profit-motivated cybercrooks and cyberspies. Fortunately Microsoft has issued a workaround that acts by disabling TIFF rendering in the affected graphics library.
TIFF is a format used frequently when scanning documents and in the publishing industry – and is desirable to design types because it is a lossless format in which vector-based clipping paths can be included. It’s not that popular outside of the design world, however, as it is not the most compatible of extensions. So for most corporates, applying the workaround isn’t going to be any inconvenience. ®