Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2012.0128.2
An unpatched vulnerability has been identified in Internet
Explorer 7, 8 and 9
19 September 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Internet Explorer 7
Internet Explorer 8
Internet Explorer 9
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Mitigation
CVE Names: CVE-2012-4969
Member content until: Thursday, October 18 2012
Comment: AusCERT has received reports that this vulnerability is currently
being exploited in the wild.
Revision History: September 19 2012: Added CVE reference number
September 18 2012: Initial Release
OVERVIEW
A serious vulnerability has been identified in Internet Explorer
versions 7, 8 and 9. While Microsoft has yet to publish an update to
correct this issue, it appears that proof of concept code exists for
this vulnerability and there are reports of it being actively
expoloited in the wild. [1, 2]
IMPACT
This vulnerability could allow for code execution within the context of
the Internet Explorer user if a user browses to a malicious
website. [3]
MITIGATION
At the time of publication of this bulletin, Microsoft has yet to
release a patch to correct this issue. It is advised that
administrators consider mitigating this risk via a number of methods:
* A pre-defined list of "business related Internet sites" can be used
to reduce the surface exposure of Internet Explorer. If the list of
business-critical URLs has been pre-defined in an organisation's
content filter, it is possible to allow users to continue using
internal / intranet sites, and only expose Internet Explorer to
trusted Internet sites. Note that compromises can occur through
advertisement panels even from trusted sites, however using a business
related sites list mitigates this threat to a large degree.
* Where possible administrators should consider using an alternative
web browser until this vulnerability has been patched.
In light of this unpatched vulnerability it is a good opportunity for
a timely reminder on the importance of having and adequate incident
response plan. For example, how can your organisation reduce the
effects should a vulnerability be used against you? Are users educated
on safe browsing practices and are you able to recover servers in a
timely fashion as well as other strategies that can reduce the impact
of a successful attack. This is not an exhaustive list, however the
key message is not just to try and block an attack, but to be prepared
to reduce the impact should an attack be successful.
REFERENCES
[1] Exploit Released for Zero-Day in Internet Explorer
http://krebsonsecurity.com/2012/09/exploit-released-for-zero-day-in-internet-explorer/
[2] IE Zero Day is "For Real"
https://isc.sans.edu/diary/IE+Zero+Day+is+For+Real+/14107
[3] IE execCommand fuction Use after free Vulnerability 0day en
http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day_en/
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUFk57O4yVqjM2NGpAQJjzw//e6AZES0cVdMNSsZI/wd14v0dCI28DK/u
rIehcBIL+X06kKU1OhDNw7RhCZOr4XGgpuTaxf0/yUsLSbmBmDgKIwuSenTvOKIl
9zdBSpYEi3yDskn4yaerutnh463IMJiT7BsxqUPu/Uouq8ThcEJwSHZ8j4f50PqD
rn/IT41F1CC1f5PNq4XJof6uCHW9pE53QaAJquulkhdLkzD4eNZ41VusPHxI6U8Y
lqHr8r0loueRFRfS8JpsQ6iyF7Lqrc87N38gKdUajvWYb4otGxPMpZ+2ow2sHToc
HURP3qPU43w2Yirwp38osrlN6nHzm3ZaQ2nk8NBGD5A04RoygjsDjOA56+VVmhta
tDYNM2/xKueip1uZZSwrpmL19ka9CtUXa0iFLTwEkGczH9rnHZBGFmximnxDdYWr
y08xva7gh6dvPybulXtw2jTXQJsMyXGy2Zet+4POY7E975wF1ux9jnzqnMjuESPK
DBxBW4Wt1Xu3rY/4ic/whBMMTJFnY1JU2quPiE4/5ecPIkiOpTV+GKNZL6QXBiub
TVxogHhlQghyFaGSfLWF+mUi+siYrBI0N5LRLDeVGcv5Fg09trFg9nzNpah/tIrk
7fVxNLIUWRwJPcXzz7s9o0F2Ns9tgSF2hayOtTs83zrFRXOyBdQtfxui0HGXefq9
Tn8KSKW0zTk=
=beyd
-----END PGP SIGNATURE-----