Microsoft has released a patch to fix the IE 0day, CVE-2012-4969, along with four other privately reported CVEs that lead to remote code execution (CVE-2012-1529, CVE-2012-2546, CVE-2012-2548, and CVE-2012-2557). One interesting thing to note is that CVE-2012-2546 and CVE-2012-2548 only affect the most recent version of Internet Explorer, IE 9. The now-patched 0day, CVE-2012-4969, affects all supported versions from 6 through 9. Since CVE-2012-4969 affects all versions, and is actively being exploited in the wild, it is imperative that administrators roll out this patch immediately. If the patch rollout must be delayed, then mitigate these vulnerabilities by disabling ActiveX controls and Active Scripting in both the Internet and Local intranet security zones. Additionally, use Blink Endpoint Protection or EMET to protect against exploits that leverage these vulnerabilities.
You can detect vulnerable systems using Retina and Retina CS, via the following audit:
17119 - Microsoft Internet Explorer Cumulative Security Update (2744842)
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.