Talos release protection against zero-day vulnerability (CVE-2021-40444) in Microsoft MSHTML
Summary: Cisco Talos released new Snort rules on Thursday to protect against exploitation of a zero-day vulnerability in Microsoft MSHTML that Microsoft says is being actively exploited in the wild. Talos points users to SIDs 58120–58129, Snort 3 SID 300049 and ClamAV signature ID 9891528, and says it has observed malware samples exploiting the flaw uploaded to public repositories since mid-August.
Key Takeaway: No official Microsoft patch was available at the time, leaving registry changes to disable Internet Explorer ActiveX controls and Protected View for internet-sourced Office documents as the interim defenses. Talos expects the flaw to spread to more threat actors because it is easy to weaponize and relies on the malicious Office documents that commonly start infections.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-40444
- Related
- 2022 0-day In-the-Wild Exploitation…so far Cyber Risks ·CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021