New IE9 and IE10 vulnerability has been discovered and not yet patched. See details below
Code Name: Operation Snowman
Microsoft has confirmed reports of a recently active attack that surreptitiously installed malware on computers running a fully patched version 10 of the Internet Explorer browser. The attacks also work on IE 9, the company warned.
The zero-day exploit was served on vfw[.]org, the official website for the Veterans of Foreign Wars, according to a blog post published Thursday afternoon by security firm FireEye. The people behind the attack compromised the VFW website and then embedded an iframe tag that silently loaded a page on another site that hosted the exploit. While FireEye researchers didn’t identify the second site, Aviv Raff, chief technology officer of Israel-based security firm Seculert, said it was aliststatus[.]com.
These attacks as reported by FireEye and Websense are known as “watering hole attacks” because they involve compromising websites visited by particular groups of people that attackers wish to target — in these particular cases U.S. military personnel and French defense contractors.
This means that Attackers can also install this exploit on sites that request logins e.g. bank websites and use it to extract logins from users.
How it works
The exploit targets IE 10 with Adobe Flash. It aborts exploitation if the user is browsing with a different version of IE or has installed Microsoft’s Experience Mitigation Toolkit (EMET). So installing EMET or updating to IE 11 prevents this exploit from functioning. Also applying the MSHTML Shim Workaround prevents the exploitation of this 0-day, albeit temporarily
How to fix it
Microsoft published a security advisory about the vulnerability, which is tracked as CVE-2014-0322, and released a “Fix It” tool as a temporary workaround. However, the company has not yet released a regular patch through the regular Windows update channel.
The security advisory can be viewed at http://technet.microsoft.com/en-us/security/advisory/2934088 which also contains detailed steps on the workaround
A permanent fix advised by Microsoft is to upgrade to Internet Explorer 11, or switch to other browsers like Google Chrome Enterprise (for domain deployment)
You can follow the author on his blog http://androidphoneappreviews.com (for tech news that matter) or http://echo.com.ng (for free tech support and repairs), or on twitter (@kcemenike), or facebook (http://facebook.com/echosolutionsng)