Microsoft: No IE Patch For Windows XP

Windows XP Game Over: 9 Upgrade Options

Microsoft confirmed over the weekend that Internet Explorer (IE) versions 6 through 11 are susceptible to a newly discovered vulnerability, and that cyberattackers have already exploited the flaw. The company said it is investigating the bug, and it pledged to release a fix.

Microsoft will release the patch through either its monthly security update or a special out-of-cycle release. Whichever route Microsoft chooses, however, Windows XP users won't benefit. As of this month, the company no longer supports the OS. In March, XP still accounted for more than a quarter of Internet users, according to the web-tracking firm Net Applications.

In a blog post, Microsoft acknowledged that cybercriminals have already exploited the bug, but it said it is aware of only limited targeted attacks. The flaw allows remote code execution if a user visits a malicious website, which means an attacker could theoretically gain the same system privileges as the legitimate user.

[Wondering about your best option to replace WinXP? Read Windows XP Game Over: 9 Upgrade Options.]

"[Simply] looking at booby-trapped content such as a Web page or image file can trick IE into launching executable code sent from outside your network," Paul Ducklin, a researcher with the security vendor Sophos, wrote in a blog post.

In a second post related to the IE flaw, Microsoft detailed two methods to mitigate risk: enabling IE's Enhanced Protected Mode and using the company's Enhanced Mitigation Experience Toolkit (EMET) 4.1 and 5.0 Technical Preview products. Users can also, of course, use a different browser. Microsoft said accounts that are configured to allow fewer user rights could be less vulnerable than those that operate with full administrative rights.

The cybersecurity firm FireEye, which claimed credit for discovering the flaw, endorsed Microsoft's recommended precautions. In a blog post, the company said its testing found EMET versions 4.1 and 5.1 and Enhanced Protected Mode all successfully break or detect the exploit.

FireEye also noted that the vulnerability relies on Adobe Flash. "Disabling the Flash plugin within IE will prevent the exploit from functioning."

The United States Computer Emergency Readiness Team, a division of the Department of Homeland Security, recommends that users and administrators enable Microsoft EMET where possible and consider employing an alternative web browser until an official update is available.

FireEye said it is monitoring a group currently exploiting the flaw. The firm noted that the group has capitalized on zero-days in the past. The attackers are "extremely proficient at lateral movement and are difficult to track, as they do typically do not reuse command and control infrastructure."

The company nicknamed the group's campaign "Operation Clandestine Fire." However, citing the ongoing nature of its investigation, it declined to provide additional details, such as which companies or institutions have been targeted.

Though not as potentially widespread as the Heartbleed vulnerability disclosed this month, the new IE exploit could represent a significant threat. According to Net Applications, the browser family accounts for around a quarter of all Internet users

All versions of IE are affected, including those running on Windows 7, 8, and 8.1. But Windows XP users face the most serious threats. Brian Krebs, the security researcher who first reported last year's Target data breach, said in a blog post, "This is the first of many zero-day attacks and vulnerabilities that will never be fixed for Windows XP users." He noted that many of the exploit mitigation techniques that EMET brings do not work in XP.

Microsoft no longer supports XP, but many third-party security vendors do, which could give some IE-using XP holdouts another option. Ducklin suggested other workarounds, including disabling an IE extension called VGX.DLL, which is believed to be linked to the exploit.

Emerging standards for hybrid clouds and converged datacenters promise to break vendors' proprietary hold. Also in the Lose The Lock-In issue of InformationWeek: The future datacenter will come in a neat package (free registration required).