Microsoft Investigates IE 9, 10 Vulnerability Targeted in Attacks

Microsoft said it is investigating an Internet Explorer vulnerability at the center of reports of attacks against IE 10.

The company did not say when a patch would be available for users, but confirmed that the vulnerability also impacts Internet Explorer 9 as well.

“We will take the necessary steps to protect customers; meanwhile, we recommend customers upgrade to Internet Explorer 11 for added protection,” a Microsoft spokesperson told SecurityWeek.

According to security researchers, the issue is a use-after-free-remote code execution vulnerability. It was first reported last week by FireEye after it was spotted being used in a watering hole attack targeting VFW.org, the Veterans of Foreign Wars website. The attack is no longer active. However when it was, visitors to the site would be hit with an iFrame that would load a second compromised page in the background. The iFrame loaded a malicious Flash file that exploited the zero-day in IE 10.

Since first being spotted, the vulnerability has also been seen used in other attacks as well. For example, researchers at Websense say the vulnerability (CVE-2014-0322) was being used as early as Jan. 20. In this case, the attack appears to be targeting organizations associated with the French aerospace association GIFAS. The exploit in the attack is hosted on a US server.

“The similarities in the exploit, delivery and search for the EMET.DLL indicate that the same group of threat actors is most likely behind the malicious URL above and the attacks that have been covered by FireEye,” according to Websense.

That attack was traced by FireEye to the same actors they believe are responsible for Operation DeputyDog and have targeted both U.S. and Japanese organizations in the past.

“Two versions of Windows are not affected by this threat: Windows 8.1 (because it includes IE11), and Windows XP (because it only supports up to IE8),” blogged Jonathan Leopando of Trend Micro. “All other versions of Windows are at potential risk, depending on the version of Internet Explorer present on the system.”