Internet Explorer zero-day discovered 'in the wild'
Yesterday Microsoft released an emergency patch for a zero-day Internet Explorer vulnerability discovered "in the wild"; which is to say, that is being used real-time by criminals to gain control of infected machines via watering hole and spear-phishing attacks. &nbsp;It is understood that the vulnerability affected all IE versions from IE7 through to IE11, potentially impacting some 220m Internet Explorer users globally.
A critical memory corruption vulnerability in Internet Explorer versions 7 through 11 that Microsoft released an emergency patch for yesterday is being used in watering hole and spearphishing attacks. Successful exploitation enables remote code execution and grants the attacker the same privileges as the current user.

The vulnerability, CVE-2015-2502, is a memory corruption bug, exploited by a hacker either hosting a malicious website or running malicious content on a legitimate site.

The attack seen in the wild has been using a malicious IFrame and drops a variant of the PlugX remote access Trojan, which calls a command-and-control server based in Korea, according to Heimdal Security.

“The recently exposed flaw does allow remote code execution so it is in a class that is pretty serious," says Cris Thomas, strategist at Tenable Network Security. "The key here though, and the reason why Microsoft issued an out-of-band patch, isn't because this bug is super bad, but because bad guys are using this bug right now to break into people’s systems. However, Microsoft hasn't released any information with regards to how extensive that usage is. It is possible that this issue is only being used in selective, highly targeted attacks or it could be in widespread use on a botnet or third party web advertising network.

"Unfortunately, there are no work-arounds for this bug. Ensuring that you have Microsoft's Enhanced Mitigation Experience Toolkit configured will make exploiting this bug more difficult, but not impossible."