UPDATED 5/1/2014: Microsoft has released an emergency out-of-band update for Internet Explorer that resolves this issue. They are including updates to IE in Windows XP as well. We recommended deploying this update as soon as possible.
Microsoft released an advisory on April 26th:
Microsoft is aware of limited, targeted attacks that attempt to exploit a vulnerability in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.
The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.
Mitigation Steps (Details on TechNet):
- Install EMET . According to Fireeye, “EMET versions 4.1 and 5.0 break (and/or detect) the exploit in our tests.”
- Also according to Fireeye, “Enhanced Protected Mode in IE breaks the exploit in our tests”. Keep in mind that Enhanced Protection Mode in IE can break some plugins.
- Disable Flash . The vulnerability is not a Flash vulnerability, but flash is required to exploit.
WARNING: Windows XP
For organizations and users who have not upgraded from Windows XP, this vulnerability does affect IE6-IE8 which can run on Windows XP. Windows XP will not be receiving updates as it is now out of support. It is critical that organizations upgrade from Windows XP.
