Microsoft has had to release a last-minute emergency patch for Windows that fixes a critical security vulnerability.
The patch, which comes out of sync with the usual monthly patch Tuesday releases, fixes a flaw that leaves users open to a ‘remote code execution’ that gives an attacker the same user rights as the user themselves on an affected machine.
Microsoft labelled the flaw as “critical”, and affected Internet Explorer versions 7, 8, 9, 10, 11 on Windows clients as well as Windows servers.
However, Microsoft noted that attackers had not yet taken advantage of the vulnerability.
“An attacker who successfully exploited this vulnerability could gain the same user rights as the current user,” said Microsoft. “Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.”
Microsoft’s new Edge browser, which was ushered in under Windows 10, is not affected by the flaw.
“An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit this vulnerability,” said Microsoft in its advisory statement.
“In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an instant messenger or email message that takes users to the attacker’s website, or by getting them to open an attachment sent through email.”
Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector
Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…
Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…
Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…
Explore the future of work with the Silicon In Focus Podcast. Discover how AI is…
Executive hits out at the DoJ's “staggering proposal” to force Google to sell off its…