Windows 0-Day Vulnerability Workaround

A new 0-day vulnerability has been confirmed yesterday. The vulnerability affects all client and server versions of Microsoft Windows up to and including Windows 7 and Windows Server 2008 R2.

Security Advisory 2501696 reveals that the "vulnerability exists due to the way MHTML interprets MIME-formatted requests for content blocks within a document" and that it "could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure".

The vulnerability exists due to the way MHTML interprets MIME-formatted requests for content blocks within a document. It is possible under certain conditions for this vulnerability to allow an attacker to inject a client-side script in the response of a Web request run in the context of the victim's Internet Explorer. The script could spoof content, disclose information, or take any action that the user could take on the affected Web site on behalf of the targeted user.

An example of a possible attack is given by Angela Gunn at the MSRC blog:

For instance, an attacker could construct an HTML link designed to trigger a malicious script and somehow convince the targeted user to click it. When the user clicked that link, the malicious script would run on the user's computer for the rest of the current Internet Explorer session. Such a script might collect user information (eg., email), spoof content displayed in the browser, or otherwise interfere with the user's experience.

Microsoft admits that proof-of-concept code has been published but mentions that they are not aware of active exploitations of the issue.

A workaround has been posted on the Security Advisory page. It basically locks down the MHTML protocol to protect the Windows operating system from possible exploits. Users need to modify the Windows Registry if they follow the suggested actions on the Security Advisory page. Administrators find information on how to apply it across domains by using Group Policy there as well.

Another option is to change the Internet Explorer security settings to high to block ActiveX Controls and Active Scripting. This may have an impact on websites and services that make use of the technologies.

A Fix-It solution has been created as well which makes the patching more comfortable. All you need to do is run the small program and follow the instructions on-screen to fix the issue on your Windows Pc.

Advertisement