

Vulnerability in Internet Explorer Could Allow Remote Code Execution - lelf
https://technet.microsoft.com/en-US/library/security/2963983

======
eps
Mitigated by EMET.

If you are on Windows and you are _not_ running EMET, you should really drop
everything right now and install it.

[http://www.microsoft.com/emet](http://www.microsoft.com/emet)

~~~
bananas
No you shouldn't.

1\. It breaks a lot of stuff.

2\. It isn't very good:

[http://bromiumlabs.files.wordpress.com/2014/02/bypassing-
eme...](http://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf)

At best it's a dose of Tamiflu.

As many people before have said, you can't retrospectively apply security
mitigations properly; you have to design them in from the start.

~~~
Spittie
1\. Really? I've been using it for a while, and no breakage. Sure, I just use
the default rulelist instead of applying rules to everything (which imo is
what most people should do).

2\. Sure, but it's better than nothing. As parent said, this exploit is
mitigated by EMET. See [http://rationallyparanoid.com/articles/emet-
testing.html](http://rationallyparanoid.com/articles/emet-testing.html) for
more tests

Yes, it's a bandaid. But since it help and it's free, why not?

~~~
bananas
We've had a couple of older COM-based applications that target Windows 5.1
(2003/XP) platforms fail unpredictably with it on later operating systems.
Whether these are just badly behaved applications or compilers or a faulty
design in EMET we don't know as it's all closed source and when you're left
with a steaming minidump (because you can't catch these unless you use ADplus)
it's not easy to work out why a process failed from that if EMET shot it.

As for the better than nothing, yes until your phone starts ringing like a
cheesy sci-fi flick because half your MSMQ sinks are crashing...

My comment above probable shouldn't have been: no you shouldn't use it until
you've soak tested your applications on it.

~~~
noinsight
EMET should show a notification when it blocks something and it should also
make an event log entry. (These are configurable iirc.)

------
mkempe
The subtitle has the meat: "Vulnerability in Internet Explorer Could Allow
Remote Code Execution".

"Microsoft is aware of limited, targeted attacks that attempt to exploit a
vulnerability in [IE 6 through 11]." \--date published: April 26, 2014.

~~~
easy_rider
I think remote code execution and the easy method for payload delivery
warrants a high level of concern.

~~~
rainforest
It seems from the subtitle that this isn't just a known vulnerability, but one
being exploited in the wild, if I'm not mistaken. Definitely a serious concern
either way though.

------
ld00d
XP is absent from the list of affected OSes. Does that mean XP isn't affected,
or is it just off the radar now that it's no longer supported.

Could this be the first big unpatched XP hole?

~~~
0x0
Isn't there an extended, for-pay support service for xp? In that case, it must
mean a patch will be engineered and released to paying customers. How long
until these leak out and pirates start trading XP patches?

~~~
TheLoneWolfling
How long until people start offering unofficial patches that include
backdoors?

