Microsoft Warns of Attacks on IE Zero-Day
Summary: Microsoft warned of limited, targeted attacks exploiting a previously unknown flaw, CVE-2014-1776, in every supported version of Internet Explorer, which could silently install malicious software when a user merely browses to a hacked or malicious site. FireEye, credited with discovering the attack, said the exploit targets IE9 through IE11 and uses a known Flash exploitation technique to bypass Windows security protections, while the weakness also exists in earlier versions back to IE6.
Key Takeaway: Microsoft had no Fix-It available at the time and pointed users to EMET 4.1, noting EMET 3.0 does not mitigate the attack and that many of EMET's mitigation techniques do not work on Windows XP, which had just received its final updates.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-1776
- Related
- CVE-2014-1776: Microsoft Internet Explorer Memory Corruption Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022Internet Explorer & Adobe Flash 0-Day Coverage Cyber Risks ·