Unfortunately, the security industry was not going to escape 2012 without seeing yet another zero-day vulnerability in Microsoft's Internet Explorer. It has been discovered that a targeted attack, leveraging a zero-day in IE, has been posed against the Council on Foreign Relations Portal. The technical origin of the flaw is as follows: the vulnerability occurs due to a CButton object being used after it is freed in mshtml!CMarkup::OnLoadStatusDone and has been assigned CVE-2012-4792. The known targeted exploit relies on both Java 1.6 and Adobe Flash (the dynamic duo of client side attack vectors, as of late) to achieve code execution on Windows 7 (as well as those still rocking Win XP, or browsing from their server OS's) and only affects Internet Explorer 8 and lower. Also of note is that a Metasploit module for this vulnerability has been released.
Fortunately for all of us, Java 1.6 is going to be end-of-lifed in February 2013 with the release of Java SE 6 Update 39.
It is recommended that users of Java 1.6 upgrade to Java 1.7, or alternatively, simply upgrade to IE 9/10 or use Google Chrome.
Update: A Fix it solution has been supplied by Microsoft, which can be used to mitigate the attack vector until a patch is released. It can be found at http://support.microsoft.com/kb/2794220.
BeyondTrust Customers
For those customers relying on Retina CS for enterprise threat management or Retina Network for vulnerability scanning can detect this vulnerability with Audit 17920 - Microsoft Internet Explorer Remote Code Execution (Zero-Day). So run a quick scan before you put the champagne on ice for NYE.
