Microsoft’s November Patch Tuesday update is now out, and once again the Internet Explorer Web browser is at the top of the list. In total, Microsoft issued eight security bulletins today, fixing 19 security vulnerabilities.
Of the 19 flaws, 11 are directly related to Microsoft’s much-maligned Internet Explorer browser. One of the IE vulnerabilities is identified as CVE-2013-3918, which is a highly critical zero-day flaw that is already being actively exploited in the wild.
According to Microsoft’s security advisory on the flaw, the vulnerability is related to an ActiveX control for the “InformationCardSigninHelper” class.
“The vulnerability could allow remote code execution if a user views a specially crafted Web page with Internet Explorer, instantiating the ActiveX control,” Microsoft warns in its advisory.
The zero-day flaw in Internet Explorer is really in an Active X component and is addressed by simply disabling the ActiveX with a KillBit setting, which is what the MS13-090 does, Wolfgang Kandek, CTO of security specialist Qualys told eWEEK.
“The underlying vulnerabilities will have to be addressed with separate patches, in that ActiveX component and in a Windows component that leaks address information,” Kandek said. “However, this particular attack is well taken care of, and we can wait for the real patches to be delivered at a future date.”
In addition to the zero-day patch, Microsoft also has a cumulative IE patch. Typically, Microsoft will roll up all its IE updates into a single advisory, but that’s not what happened this month. The CVE-2013-3918 is also somewhat unique in that Microsoft has made it a stand-alone fix and is not part of the cumulative MS13-088 IE update. The MS12-088 advisory patches 10 separate IE vulnerabilities, spanning IE 6 all the way to the latest IE 11 browser releases.
The impact of having the IE zero-day in a separate bulletin isn’t huge, Tyler Reguly, technical manager of security research and development at security firm Tripwire, told eWEEK.
“The biggest concern would be admins that mistakenly install the IE cumulative update, expecting it to resolve the zero-day,” Reguly said. “We need to make sure that the location of the zero-day patch [MS13-090] is communicated very clearly to everyone, regardless of their involvement in the security community.”
While Microsoft has fixed one zero-day flaw with the MS13-090 patch, there is still one more zero-day flaw that has been left unpatched. There is also a TIFF graphics format vulnerability that is being exploited in the wild. Microsoft has issued a “fix-it” workaround for the issue, though a full patch is not currently available.
There’s always a concern when there’s a zero-day out in the wild, Reguly said.
“I’d love to see an out-of-band patch to resolve this issue, but the reality is that we won’t likely see a patch for this until December’s Patch Tuesday,” Kandek said. “In the meantime, admins have to remain vigilant when monitoring their networks and, if possible, disable TIFF files.”
With the first public announcement of the flaw a week ago, more attackers are now working on reverse-engineering the flaw, Qualys’ Kandek said.
“I would recommend everybody make the registry change on all machines, either with their system management tool, or by pushing out that MSI file that Microsoft makes available in KB2896666,” Kandek advised.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.