September 18, 2012, 8:36 PM — Microsoft has confirmed reports that a zero-day vulnerability in its Internet Explorer Web browser is being actively attacked in the wild. While Microsoft works diligently to crank out a patch, it's important for businesses and consumers to understand the threat, and the steps that can be taken to avoid compromise while you wait.
Microsoft has published a security advisory acknowledging the threat. According to Microsoft, the zero-day exploit affects Internet Explorer 7, 8, 9. Internet Explorer 10 is not impacted, but it's not completely safe because it remains vulnerable to flaws in the embedded Adobe Flash.
The Microsoft advisory includes some tips that can be used to defend against this threat pending a patch for the underlying flaw. Microsoft recommends that customers use the Enhanced Mitigation Experience Toolkit (EMET) to implement mitigations that can prevent the zero-day exploit from working. In addition, Microsoft advises customers to set the Internet and local intranet security zone in Internet Explorer to "High" to block ActiveX controls and Active Scripting from running, or at least configure it to prompt before executing.
Andrew Storms, director of security operations for nCircle, puts the threat in perspective. "If your systems are running IE, you are at risk, but don't panic. The reality is it's just one more zero-day and we've seen an awful lot of them come and go."
However, Storms isn't confident that business customers will appreciate the guidance from Microsoft. "If you set your Internet and local security zones to 'High' as recommended to block ActiveX controls and Active Scripting, there's a very good chance necessary business applications will be adversely affected."
The Metasploit exploit for the Internet Explorer zero-day relies on the presence of Java on the target system. That means that PCs without Java are safe against the Metasploit-based exploits, and that it might be a great time to reevaluate whether your PCs really need to run Java. If you don't actually use Java, uninstall it.