Exploits, more details for unpatched IE vulnerability

Exploits, more details for unpatched IE vulnerability

Summary: Three separate targeted attack campaigns have been using the vulnerability, and now an exploit has been released on Metasploit. Microsoft has released a Fix it but not a patch.

TOPICS: Security

The SANS Internet Storm Center is reporting that Metasploit has released an exploit module for an unpatched vulnerability in Internet Explorer disclosed last week by Microsoft.

The exploit module should grease the wheels for attackers seeking to infect users' systems, but according security firm FireEye, who first revealed attacks using the vulnerability, 3 separate campaigns are ongoing using it already.

Microsoft has released a Fix it for the vulnerability, which has been designated CVE-2013-3893, but still has no word on when a patch will be available for it or if they will go out of band to do so. Microsoft has also released instructions in the advisory for how to use their EMET tool to block exploits.

Topic: Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • At any given moment

    I wonder how many actual zero-day exploits exist in the wild, and are only known about by the wrong people to know about them.....
    • No idea - but this is one!

      I suggest dealing with the issue at hand, rather than pondering about questions that you can never know the answer to.
      • ??

        That was a useful response. Yeah, zero-day exploits are a fact of life and there is nothing anybody can do about them except wait for them to be discovered. Who knows where the code comes from and who knows how it might affect stuff -- it's simply beyond what we humans can ever comprehend....

        • Huh? What are you raving about?

          Fact: There is a zero-day bug in IE. If this affects you then I suggest you stop ranting on ZDNet and take steps to protect yourself.

        • Valid point, BC

          Identifying the issue and pouncing on it is very much a "Whack-a-Mole" approach to dealing with this sort of issue. BC's question clearly reflects a more enlightened approach than poor Zogg's (and, by extention, Microsoft's), who contents himself chasing the critters as they appear. Problem(s) with that is(are): how quick can you identify them? is this the best approach to dealing with these exploits? is this a design issue? could/would/does dead-weight legacy code have something to do with it?

          And more.

          BC, you've an enlightened way of thinking. Zogg, enjoy chasing your moles: here's another hammer for ya. ;)