Microsoft has issued Vulnerability-related.PatchVulnerability an emergency , out-of-band patch for an Internet Explorer zero-day that was being actively exploited Vulnerability-related.DiscoverVulnerability in targeted attacks . The company says that it learned about the vulnerability through a report from Google . CVE-2018-8653 affects Vulnerability-related.DiscoverVulnerability a range of versions of Internet Explorer from 9 to 11 , across Windows 7 to 10 and Windows Server . The vulnerability amounts to a remote code execution exploit , and it was first spotted Vulnerability-related.DiscoverVulnerability by Google 's Threat Analysis Group . Microsoft explains Vulnerability-related.DiscoverVulnerability that a problem with Internet Explorer 's scripting engine could be exploited Vulnerability-related.DiscoverVulnerability by an attacker to execute arbitrary code on a victim 's computer . In a short security advisory , the company says : Today , we released Vulnerability-related.PatchVulnerability a security update for Internet Explorer after receiving a report Vulnerability-related.DiscoverVulnerability from Google about a new vulnerability being used in targeted attacks . Customers who have Windows Update enabled and have applied Vulnerability-related.PatchVulnerability the latest security updates , are protected automatically . We encourage customers to turn on automatic updates . Microsoft would like to thank Google for their assistance . In a more detailed security vulnerability posting , Microsoft explains the impact of the problem : A remote code execution vulnerability exists in Vulnerability-related.DiscoverVulnerability the way that the scripting engine handles objects in memory in Internet Explorer . The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user . An attacker who successfully exploited Vulnerability-related.DiscoverVulnerability the vulnerability could gain the same user rights as the current user . If the current user is logged on with administrative user rights , an attacker who successfully exploited Vulnerability-related.DiscoverVulnerability the vulnerability could take control of an affected system . An attacker could then install programs ; view , change , or delete data ; or create new accounts with full user rights . In a web-based attack scenario , an attacker could host a specially crafted website that is designed Attack.Phishing to exploit the vulnerability through Internet Explorer and then convince Attack.Phishing a user to view the website , for example , by sending Attack.Phishing an email . The security update addresses Vulnerability-related.PatchVulnerability the vulnerability by modifying Vulnerability-related.PatchVulnerability how the scripting engine handles objects in memory .

Researchers at Trustwave are warning Vulnerability-related.DiscoverVulnerability of a hidden backdoor in VoIP devices produced by Chinese manufacturer DBL Technology which could allow access by the manufacturer or malicious third parties . The issue is with the authentication process , allowing a remote attacker to gain a shell with root privileges on an affected device , Trustwave researcher Neil Kettle explained Vulnerability-related.DiscoverVulnerability in a blog post . “ The Telnet interface of the GoIP is documented as providing information for users of the device through the use of logins ‘ ctlcmd ’ and ‘ limitsh ’ . However , an additional undocumented user , namely ‘ dbladm ’ is present which provides root level shell access on the device . Instead of a traditional password , this account is protected by a proprietary challenge-response authentication scheme , ” he explained . “ Investigation has shown this scheme to be fundamentally flawed in that it is not necessary for a remote user to possess knowledge of any secret besides the challenge itself and knowledge of the protocol/computation ” . This is apparently in contrast to more secure challenge-response schemes such as password-based log-ins where the user is asked for a password , which is then obscured to guard against “ network interception and replay attacks ” . The issue was first spotted Vulnerability-related.DiscoverVulnerability by Trustwave in an 8 port VoIP GSM Gateway from the company . However , it ’ s since been discovered Vulnerability-related.DiscoverVulnerability present in GoIP 1 , 4 , 8 , 16 and 32 and could affect Vulnerability-related.DiscoverVulnerability many more DBL Technology devices and OEM kit . More worryingly , when contacted last October , the firm did not fix Vulnerability-related.PatchVulnerability the issue . “ Verification of the patched version reveals that the challenge response mechanism is still present in the latest version albeit a little more complex . It seems DBL Technology engineers did not understand that the issue is the presence of a flawed challenge response mechanism and not the difficulty of reverse engineering it , ” explained Kettle . “ The main differences between the latest challenge response mechanism and the older variant is the level of complexity it employs : a simplistic MD5 with a linear equation changed to several 'round ' functions mixed with a modified version of the MD5 hash algorithm ”