Internet Explorer End of Life (EOL) on Windows 10

Although not unexpected, Microsoft has officially announced the End of Life (EOL) for Internet Explorer 11 on Windows 10.  Internet Explorer 11 will go out of support on June 15, 2022, for certain versions of Windows 10.   From The future of Internet Explorer on Windows 10 is in Microsoft Edge:

Note: This retirement does not affect in-market Windows 10 LTSC or Server Internet Explorer 11 desktop applications. It also does not affect the MSHTML (Trident) engine. For a full list of what is in scope for this announcement, and for other technical questions, please see our FAQ.

Edge legacy was replaced by Edge Chromium with the April 13, 2021 security updates.  With built-in IE Mode for websites built to work with Internet explorer, the new Edge makes Internet Explorer unnecessary.  IE Mode can be activated using the following simple steps:

• In the address bar for Microsoft Edge, type edge://settings/defaultbrowser and then click Enter.
  
• Slide the Allow sites to be reloaded in Internet Explorer toggle to ON.
  
• Restart Microsoft Edge.

In addition to enhanced security and other improvements over Internet Explorer, the options for extensions available for Edge is almost endless.  If the extension you are seeking isn't available in Microsoft Edge Add-ons, you will most likely find what you are seeking in the Chrome Web Store.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Out-of-Band Security Update for Internet Explorer

Microsoft released an out-of-band security update for Internet Explorer 11 on Windows 10, Internet Explorer 11 on Windows 8.1 Update, Internet Explorer 11 on Windows 7 SP1, Internet Explorer 10 on Windows Server 2012, Internet Explorer 9, Windows Embedded Standard 2009 and Windows Embedded POSReady 2009.

The update addresses  remote code execution vulnerability CVE-2018-8653 that exists in the way that the scripting engine handles objects in memory in Internet Explorer.

It is strongly advised that this update be installed as soon as possible. (Note: For Windows RT and Windows RT 8.1, this update is available through Microsoft Update only.)

 
More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

References

• CVE-2018-8653
• Security Advisory
• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Updates to Internet Explorer ActiveX Blocking

Blocking of out-of-date ActiveX controls was added to Internet Explorer versions 9 through 11 in October.  
With the update being released in November (11NOV2014), Microsoft is adding additional changes to out-of-date AxtiveX control blocking. 

To be included will be updates to currently supported operating system and browser combinations.  This is a welcome addition for users of Windows Vista.  Another addition to ActiveX blocking will include blocking out-of-date Silverlight.

Note:  After January 12, 2016, only the following configurations will be supported:

Windows operating system	Internet Explorer version
Windows Vista SP2	Internet Explorer 9
Windows Server 2008 SP2	Internet Explorer 9
Windows 7 SP1	Internet Explorer 11
Windows Server 2008 R2 SP1	Internet Explorer 11
Windows 8.1	Internet Explorer 11
Windows Server 2012	Internet Explorer 10
Windows Server 2012 R2	Internet Explorer 11

References:

• Stay up-to-date with Internet Explorer
• October 2014 updates and a preview of changes to out-of-date ActiveX control blocking

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Out of Band Security Update for IE Zero-Day Vulnerability

Microsoft released an out-of-band security update to address the security vulnerability in Internet Explorer described in Microsoft  Security Advisory 2963983.

Of important note:  Although Windows XP is no longer supported by Microsoft, the decision was made to issue a security update for Windows XP users.

Critical:

• MS14-021 -- Security Update for Internet Explorer (2965111) 
  
  This security update resolves a publicly disclosed vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using an affected version of Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

References

• MSRC:   Out-of-Band Release to Address Microsoft Security Advisory 2963983
• MSRC:   Security Update Released to Address Recent Internet Explorer Vulnerability
• TechNet: Microsoft Security Bulletin

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Security Advisory 2963983, IE Zero-Day Vulnerability

Microsoft released Security Advisory 2963983 which relates to a vulnerability in Internet Explorer.

With the vulnerability, an attacker could cause remote code execution if someone visited a malicious website with an affected browser. Generally, this would occur by an attacker convincing someone to click a link in an email or instant message.

Although the vulnerability affects all versions of IE, at this time, Microsoft is aware of limited, targeted attacks, in which the exploit observed appears to target IE9, IE10 and IE11.


Additional details about the exploit are available from the FireEye Blog, New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks.

Recommendations 

As illustrated in the "Security Research and Defense Blog" reference below, users of IE 10 and 11 should ensure they haven't disabled Enhanced Protection Mode. 

Another option is to install the Enhanced Mitigation Experience Toolkit (EMET).  The recommended setting for EMET 4.1, available from KB Article 2458544, is automatically configured to help protect Internet Explorer. No additional steps are required.

See the Tech Net Advisory for instructions on changing the following settings to help protect against exploitation of this vulnerability:

• Change your settings for the Internet security zone to high to block ActiveX controls and Active Scripting
• Change your settings to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone. 

References:

• CVE Reference:  CVE-2014-1776
• Microsoft KB Article 2953095: Microsoft security advisory: Vulnerability in Microsoft Word could allow remote code execution
• MSRC: Microsoft Releases Security Advisory 2963983
• Security Research & Defense: More Details about Security Advisory 2963983 IE 0day
• Tech Net Advisory:  Microsoft Security Advisory (2963983) Vulnerability in Internet Explorer Could Allow Remote Code Execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Advisory 2934088

Microsoft released Security Advisory 2934088 which impacts Internet Explorer 9 and 10. Internet Explorer 6, 7, 8 and 11 are not affected.

Although Internet Explorer 9 is vulnerable, at this time, Microsoft is only aware of limited, targeted attacks against Internet Explorer 10. This issue allows remote code execution if users browse to a malicious website with an affected browser. This would typically occur by an attacker convincing someone to click a link in an email or instant message.

Recommendations

Users of Internet Explorer 10 should update to IE11, available here.

If you use Internet Explorer 9 or 10 and are unable to update to Internet Explorer 11, it the below-linked Fix it solution is strongly advised.
 

Enable Fix it	Disable Fix it
Microsoft Fix it 51007	Microsoft Fix it 51008

Another option is to install the Enhanced Mitigation Experience Toolkit (EMET), described in the "workarounds" section of the Tech Net Advisory as well as the Security Research and Defense Blog article.

References:

• CVE Reference:  CVE-2014-0322
• Microsoft KB Article 2896666: Microsoft security advisory: Vulnerability in Internet Explorer could allow remote code execution
• MSRC: Microsoft Releases Security Advisory 2934088
• Security Research & Defense: Fix it tool available to block Internet Explorer attacks leveraging CVE-2014-0322
• Tech Net Advisory:  Microsoft Security Advisory (2934088) Vulnerability in Internet Explorer Could Allow Remote Code Execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...