Operation Clandestine Fox - Internet Explorer vulnerability
Operation Clandestine Fox refers to a vulnerability in Internet Explorer (IE) that would allow owners of malicious websites to gain complete access to the site visitor's computer if the visitor used IE version 6 and up. With access to the computer, hackers could engage in a number of malicious activities like install apps or even use the infected computer as their own. The vulnerability affects IE 6 through IE 11, but the attack is targeting IE 9 through IE 11.
FireEye Discovers and Explains the IE Vulnerability
The Internet Explorer vulnerability was named Operation Clandestine Fox by FireEye, the security company credited with finding the vulnerability. The exploit, according to FireEye, leverages a previously unknown use-after-free vulnerability, and uses a well-known Flash exploitation technique to achieve arbitrary memory access and bypass Windows’ ASLR and DEP protections.
Symantec also issued an alert regarding the vulnerability, noting the fact that Windows XP users are particularly susceptible. Symantec testing confirmed that the vulnerability crashes Internet Explorer on Windows XP. This will be the first zero-day vulnerability that will not be patched for Windows XP users, as Microsoft ended support for the operating system.
IE Security Vulnerability in the News
Microsoft Web Browser Security Bug Could Impact Millions of Users
Internet Explorer Security Bug: How to Protect Yourself
The Internet Explorer security bug explained and how to protect your info
Governments urge Internet Explorer users to switch browsers until fix found
Microsoft Security Advisory and Patch Details
In the Microsoft Security Advisory 2963983, Microsoft stated the following information regarding the Internet Explorer security vulnerability:
"Microsoft is aware of limited, targeted attacks that attempt to exploit a vulnerability in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.
The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs."
How Do I Protect my Computer?
Security experts have recommended that people stop using Internet Explorer until the vulnerability is patched by Microsoft. Other protective measures include using Internet Explorer’s "Enhanced Protected Mode" add-on to protect user data in an event of a security breach and disabling the Flash plug-in on Internet Explorer.
Microsoft is expected to release a patch for the security bug in the company's next Patch Tuesday update (May 13, 2014) or in an off-schedule patch that will be developed specifically for this security issue.
IT Solutions Builder TOP IT RESOURCES TO MOVE YOUR BUSINESS FORWARD
Which topic are you interested in?
What is your company size?
What is your job title?
What is your job function?
Searching our resource database to find your matches...
Stay up to date on the latest developments in Internet terminology with a free weekly newsletter from Webopedia. Join to subscribe now.
The following facts and statistics capture the changing landscape of cloud computing and how service providers and customers are keeping up with... Read More »SEO Dictionary
From keyword analysis to backlinks and Google search engine algorithm updates, our search engine optimization glossary lists 85 SEO terms you need... Read More »Texting & Chat Abbreviations
From A3 to ZZZ this guide lists 1,500 text message and online chat abbreviations to help you translate and understand today's texting lingo. Read More »
Java is a high-level programming language. This guide describes the basics of Java, providing an overview of syntax, variables, data types and... Read More »Java Basics, Part 2
This second Study Guide describes the basics of Java, providing an overview of operators, modifiers and control Structures. Read More »Network Fundamentals Study Guide
Networking fundamentals teaches the building blocks of modern network design. Learn different types of networks, concepts, architecture and... Read More »