ID: IRCNE2013011731
Date: 2013-01-13
According to "techworld", Microsoft will issue an emergency update to patch a vulnerability in Internet Explorer (IE) in the next two weeks to fix a flaw criminals have been using for more than a month, researchers said Tuesday.
The company will move on the IE6, IE7 and IE8 bug before the next regularly-scheduled Patch Tuesday because of increasing attacks and proof that temporary workarounds can be circumvented.
"I wouldn't be surprised if they go 'out-of-band,'" said Andrew Storms, director of security operations at nCircle Security, using the term for an emergency update. "They won't want to wait for five weeks, and there's enough pressure on them now to work on an out-of-band."
The pressure Storms referred to includes reports that additional websites have been spotted serving up "drive-by" attacks against older versions of IE, as well as claims from researchers that both the "Fixit" tool Microsoft deployed last week and a long-available advanced anti-exploit tool can be sidestepped.
In lieu of a patch, Microsoft issued one of its automated "Fixit" tools to block attacks, and also recommended that customers deploy the Enhanced Mitigation Experience Toolkit (EMET), a separate anti-exploit utility.
A Twitter exchange between Aaron Portnoy of Exodus and Jonathan Ness, a security engineer at Microsoft, revealed that the Fixit bypass was likely legitimate. "We think you are probably right," Ness tweeted yesterday.
"For the record ... EMET can also be bypassed to exploit CVE-2012-4792," said Exodus on its Twitter feed on Tuesday, using the IE bug's Common Vulnerabilities and Exposure's identifier.
Microsoft's next Patch Tuesday is Feb. 19, five weeks away. But Microsoft won't wait, said Jason Miller, VMware's manager of research and development, in a Tuesday interview. "They will go out of band on this," Miller said. "I think they'll [have a patch] as soon as next week, and no later than two weeks."
Emergency updates have become rare for Microsoft. The company has issued only two since September 2010.
Related Link:
Microsoft confirms zero-day bug in IE6, IE7 and IE8
Microsoft issues fix for IE flaw that could allow PC hijack
Microsoft fix for Windows IE zero day exploit is cracked
- 2