Operation Clandestine Fox (IE vulnerability)

Operation Clandestine Fox refers to a vulnerability in Internet Explorer (IE) that would allow owners of malicious websites to gain complete access to the site visitor’s computer if the visitor used IE version 6 and up. With access to the computer, hackers could engage in a number of malicious activities like install apps or even use the infected computer as their own. The vulnerability affects IE 6 through IE 11, but the attack is targeting IE 9 through IE 11.
FireEye Discovers and Explains the IE Vulnerability

The Internet Explorer vulnerability was named Operation Clandestine Fox by FireEye, the security company credited with finding the vulnerability. The exploit, according to FireEye, leverages a previously unknown use-after-free vulnerability, and uses a well-known Flash exploitation technique to achieve arbitrary memory access and bypass Windows’ ASLR and DEP protections.

Symantec also issued an alert regarding the vulnerability, noting the fact that Windows XP users are particularly susceptible. Symantec testing confirmed that the vulnerability crashes Internet Explorer on Windows XP. This will be the first zero-day vulnerability that will not be patched for Windows XP users, as Microsoft ended support for the operating system.
IE Security Vulnerability in the News

Microsoft Web Browser Security Bug Could Impact Millions of Users
Internet Explorer Security Bug: How to Protect Yourself
The Internet Explorer security bug explained and how to protect your info
Governments urge Internet Explorer users to switch browsers until fix found

Microsoft Security Advisory and Patch Details

In the Microsoft Security Advisory 2963983, Microsoft stated the following information regarding the Internet Explorer security vulnerability:

“Microsoft is aware of limited, targeted attacks that attempt to exploit a vulnerability in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.

The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.”

How Do I Protect my Computer?

Security experts have recommended that people stop using Internet Explorer until the vulnerability is patched by Microsoft. Other protective measures include using Internet Explorer’s “Enhanced Protected Mode” add-on to protect user data in an event of a security breach and disabling the Flash plug-in on Internet Explorer.

Microsoft is expected to release a patch for the security bug in the company’s next Patch Tuesday update (May 13, 2014) or in an off-schedule patch that will be developed specifically for this security issue.