Internet Explorer zero-day may be even more dangerous than first thought

Date:
Fri, 10 Sep 2021 14:40:56 +0000

Description:
Security researchers examine real-world exploits to gain insight into recent yet unpatched Internet Explorer vulnerability.

FULL STORY ======================================================================

New details about the recent MSHTML zero-day vulnerability have further spooked cybersecurity researchers, after having seen exploits in the wild.

Tracked as CVE-2021-40444, Microsoft recently disclosed the vulnerability in Internet Explorer s browser engine Trident, also known as MSHTML, which helps render browser-based content inside Microsoft Office documents.

Microsoft was careful not to share too many details about the still-unpatched vulnerability. However, security researchers have been more forthcoming after analyzing malicious Office documents used in real-world campaigns. TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix
so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

Click here to start the survey in a new window << Take a look at our list of the best web browsers Protect your devices with these best antivirus software These are the best malware removal software on the market

BleepingComputer has shared details about the dangerous nature of the vulnerability, which can work around built-in protection mechanisms in both Microsoft Office and Office 365 . Exercise extreme caution

In an ideal world, Microsoft Offices "Protected View" feature is enough to block the exploit, since it exists in documents that come from the internet.

However, vulnerability analyst Will Dormann told BleepingComputer that there are several ways for a malicious document to bypass Protected View by obfuscating the fact that it came from the internet. For instance, documents opened from inside containers like zipped archives, or ISO files, are treated as local files.

Moreover, Dormann discovered that you could use this vulnerability in RTF files as well, which dont get the protections of the Protected View feature.

While Microsoft hasnt yet shared a patch to plug the vulnerability, it has shared mitigations to block documents from processing ActiveX content,
thereby defanging the exploit.

However, thats not of much help either, since security researcher Kevin Beaumont has already discovered a way to bypass Microsoft's mitigations to exploit this vulnerability.

Until Microsoft fixes the vulnerability, its best to avoid opening documents from unknown sources. Here are the best ransomware protection tools

Via BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/internet-explorer-zero-day-may-be-even-more-dan gerous-than-first-thought/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)