Unfortunately, the security industry was not going to escape 2012 without seeing yet another zero-day vulnerability in Microsoft's Internet Explorer. It has been discovered that a targeted attack, leveraging a zero-day in IE, has been posed against the Council on Foreign Relations Portal.
The technical origin of the flaw is as follows: the vulnerability occurs due to a CButton object being used after it is freed in mshtml!CMarkup::OnLoadStatusDone and has been assigned CVE-2012-4792.
The known targeted exploit relies on both Java 1.6 and Adobe Flash (the dynamic duo of client side attack vectors, as of late) to achieve code execution on Windows 7 (as well as those still rocking Win XP, or browsing from their server OS's) and only affects Internet Explorer 8 and lower. Also of note is that a Metasploit module for this vulnerability has been released.
Fortunately for all of us, Java 1.6 is going to be end-of-lifed in February 2013 with the release of Java SE 6 Update 39.
It is recommended that users of Java 1.6 upgrade to Java 1.7, or alternatively, simply upgrade to IE 9/10 or use Google Chrome.
Update: A Fix it solution has been supplied by Microsoft, which can be used to mitigate the attack vector until a patch is released. It can be found at http://support.microsoft.com/kb/2794220.
BeyondTrust Customers
For those customers relying on Retina CS for enterprise threat management or Retina Network for vulnerability scanning can detect this vulnerability with Audit 17920 - Microsoft Internet Explorer Remote Code Execution (Zero-Day). So run a quick scan before you put the champagne on ice for NYE.
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.
