1 / 6

IE Zero Day Attack

IE Zero Day Attack. 張文瑜 2014/05/05. US-CERT 緊急 聲明. US-CERT is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and could allow unauthorized remote code execution .

kiana
Download Presentation

IE Zero Day Attack

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. IE Zero Day Attack 張文瑜 2014/05/05

  2. US-CERT緊急聲明 US-CERT is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and could allow unauthorized remote code execution. US-CERT recommends that users and administrators review Microsoft Security Advisory 2963983 for mitigation actions and workarounds. Those who cannot follow Microsoft's recommendations, such as Windows XP users, may consider employing an alternate browser. For more details, please see VU#222929. 資料來源：US-CERT2014/04/28

  3. 漏洞 • 存在於IE存取記憶體中： • 未被妥善放置 • 已被刪除的物件 • 導致記憶體毀損並讓駭客有機可乘

  4. 攻擊模式 • 遠端程式碼執行漏洞： • Microsoft ：「該漏洞會使記憶體遭破壞或修改，並讓攻擊者能在使用者當前使用的 IE 瀏覽器中執行任意程式碼。」 • 再進一步利用而侵入電腦記憶體 • 建立一個特定網站來幫助「Zero Day」入侵，誘使使用者點集該網站的連結

  5. 影響 • IE6 ~ IE11，全球市占率高達57.96% • Windows XP2014/04/08支援終止，現階段全球使用率仍高達27.69%

  6. 防範 • Enhanced Mitigation Experience Toolkit（EMET） • 使用其他種類網頁瀏覽器(Chrome、Firefox、Opera、Safari) • 停用Adobe Flash和vgx.dll • 啟用防火牆功能、更新軟體或防毒程式 • IE的安全性等級設定為「高」，限制ActiveX控制項與Active Scripting指令碼的執行 • 勿任意點選E-mail中的網址 • 微軟已破例釋出修補程式：2014/05/05 https://technet.microsoft.com/library/security/ms14-021

More Related