exploitation

Software defense: mitigating common exploitation techniques

Security Research & Defense / By / June 20, 2019

In our previous posts in this series, we described various mitigation improvements that attempt to prevent the exploitation of specific classes of memory safety vulnerabilities such as those that involve stack corruption, heap corruption, and unsafe list management and reference count mismanagement. These mitigations are typically associated with a specific developer mistake such as writing …

Software defense: mitigating common exploitation techniques Read More »

CVE-2013-3893: Fix it workaround available

Security Research & Defense / By / June 20, 2019

Today, we released a Fix it workaround tool to address a new IE vulnerability that had been actively exploited in extremely limited, targeted attacks.  This Fix it makes a minor modification to mshtml.dll when it is loaded in memory to address the vulnerability. This Fix it workaround tool is linked from Security Advisory 2887505 that describes this …

CVE-2013-3893: Fix it workaround available Read More »

Mitigating the LdrHotPatchRoutine DEP/ASLR bypass with MS13-063

Security Research & Defense / By / June 20, 2019

Today we released MS13-063 which includes a defense in depth change to address an exploitation technique that could be used to bypass two important platform mitigations: Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). As we’ve described in the past, these mitigations play an important role in making it more difficult and costly …

Mitigating the LdrHotPatchRoutine DEP/ASLR bypass with MS13-063 Read More »

MS13-037 addressing Pwn2own vulnerabilities

Security Research & Defense / By / June 20, 2019

MS13-037 addresses a number of vulnerabilities in Internet Explorer, several of which were reported to us by the TippingPoint Zero Day Initiative (ZDI) program. We’ve gotten questions from customers about the specific vulnerabilities purchased by ZDI from the CanSecWest pwn2own contest. We’d like to use this blog post to provide more background on the set …

MS13-037 addressing Pwn2own vulnerabilities Read More »

Technical Analysis of the Top BlueHat Prize Submissions

Security Research & Defense / By / June 20, 2019

Now that we have announced the winners of the first BlueHat Prize competition, we wanted to provide some technical details on the top entries and explain how we evaluated their submissions. Speaking on behalf of the judges, it was great to see people thinking creatively about defensive solutions to important security problems! To set the stage …

Technical Analysis of the Top BlueHat Prize Submissions Read More »

New version of EMET is now available

Security Research & Defense / By / June 20, 2019

Today we are pleased to announce a new version of the Enhanced Mitigation Experience Toolkit (EMET) with brand new features and mitigations. Users can click here to download the tool free of charge.  The Enhanced Mitigation Experience Toolkit enables and implements different techniques to make successful attacks on your system more difficult. EMET is designed …

New version of EMET is now available Read More »

Assessing the risk of public issues currently being tracked by the MSRC

Security Research & Defense / By / June 20, 2019

At Microsoft, as at most large software vendors, we are likely to have publicly known issues under investigation at any given time. This is what we do on the Security Research & Defense team. Recently we’ve seen confusion from folks trying to make sense of some of the current public issues. To help clear that …

Assessing the risk of public issues currently being tracked by the MSRC Read More »

New Internet Explorer vulnerability affecting all versions of IE

Security Research & Defense / By / June 20, 2019

Today we released Security Advisory 2488013 to notify customers of a new publicly-disclosed vulnerability in Internet Explorer (IE). This vulnerability affects all versions of IE. Exploiting this vulnerability could lead to unauthorized remote code execution inside the iexplore.exe process. Proof-of-concept exploit bypasses ASLR and DEP The Metasploit project recently published an exploit for this vulnerability …

New Internet Explorer vulnerability affecting all versions of IE Read More »