UPDATED 19:57 EST / JANUARY 19 2020


Internet Explorer vulnerability under attack, but a fix is weeks away

A new vulnerability discovered in Internet Explorer is being exploited in the wild, but though Microsoft Corp. is promising a fix, it may be weeks away.

The vulnerability was disclosed by Microsoft Friday and was thought serious enough that it gained the attention of the U.S. Department Homeland Security Cybersecurity and Infrastructure Agency as well.

The critical vulnerability affects Internet Explorer 9, 10, and 11 on Windows 7, 8.1, RT 8.1, 10, Server 2008, 2008 R2, Server 2012, Server 2016 and Sever 2019. The remote code execution vulnerability related to how the scripting engine in IE handles objects, allowing an attacker to corrupt memory to run arbitrary code.

To exploit the vulnerability, an attacker can use a crafted web page or HTML document that can trigger IE to exploit the vulnerability. The extent of how far it has been exploited was not made clear with Microsoft saying that it’s “aware of limited targeted attacks.”

The advice from CISA, at least, is to not use IE, which, given that it has now been five years since Microsoft replaced it with Edge, would seem logical. But it’s not always possible. According to Statcounter, IE still holds a 3.56% market share of desktop browsers as of December, down from 5.4% a year before. But those holdouts exist for a reason, most commonly because legacy pages and related services require it. Those aren’t necessarily online web pages but intranet pages that have been set up to work with internal systems.

IE was famous for that, with IE 6 in particular not built on web standards and hence pages designed for the version would not work with other browsers. The later versions of IE still offered backwards compatibility through their capability mode. Over time, intranet pages have been redesigned, but it’s a process that takes time.

How many pages use IE is difficult to estimate. “There is no particular sector, we find IE used in administration as well as in health or industry for example,” Victor Poitevin, digital manager at cybersecurity firm Stormshield, wrote in July. “It is complicated to estimate the percentage of businesses that use IE. It concerns applications used internally…. We are talking about internal software, which has very often been customized for the company: intranet, accounting software, stock management software, etc.”

Image: Maxpixel

Since you’re here …

Show your support for our mission with our one-click subscription to our YouTube channel (below). The more subscribers we have, the more YouTube will suggest relevant enterprise and emerging technology content to you. Thanks!

Support our mission:    >>>>>>  SUBSCRIBE NOW >>>>>>  to our YouTube channel.

… We’d also like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.

If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.