A security vulnerability affects Internet Explorer and Office applications in certain circumstances. Microsoft has taken steps to limit the risks.
February 6, 2019. Chris Jackson, one of the cybersecurity chiefs at Microsoft, posted a post on the US company’s forums, titled ” the risks you take by using Internet Explorer by default “. Explaining why Internet users have every interest in changing web browser, the post of the interested party could be summarized as follows: you should no longer use IE to go on the web.
Two years later, Internet Explorer’s global market share has grown almost insignificant – it’s estimated at 0.6% globally in August 2021, according to Statcounter. A low score, but tricky: compared to the number of computer workstations under Windows internationally, there are potentially hundreds of thousands of individuals who are hiding behind this apparent small percentage.
It is in this context that Microsoft published an alert on September 7 regarding a security vulnerability in MSHTML. This is the rendering engine that Internet Explorer uses to display web pages (and in these circumstances is called Trident). The breach, which has a high criticality score (between 7.9 and 8.8 / 10), was spotted by malicious people
” Microsoft is investigating reports of a vulnerability in MSHTML that affects Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially crafted Microsoft Office documents “Writes the Redmond firm. It specifies that in the meantime it has taken steps to mitigate the risk.
The scenario of an attack can occur if a malicious ActiveX control (which allows programs to dialogue) is used by a Microsoft Office document – the American company’s office suite – which hosts the Internet Explorer rendering engine. . If the victim opens the trapped document, they could inadvertently give the hacker access to the Windows account used on the PC.
Protective measures are taken by Microsoft
Faced with this risk, successive measures have been taken: Microsoft’s in-house antivirus, Defender, has been updated to detect and counter the exploitation of this breach by malicious code. The company also recalls that the documents coming from the Internet and which are opened by Office are it while being locked – it is the protected mode, which makes sure that the documents are made read-only.
In addition, the company provides information on how to intervene in the Windows registry, which requires some good computer skills in order not to do anything stupid. Via the manipulation described by Microsoft, it is possible to deactivate the installation of all ActiveX controls in IE to protect against this. This will not prevent ActiveX controls already installed from functioning, without risk.
It should be noted that other peripheral measures can play a role in the safety of Internet users. We know that Microsoft is embarked on a plan to end IE: in November 2020, Teams stopped supporting IE 11, the latest version of the browser. Then, in August 2021, the same scenario played out for Microsoft 365, the company’s online office suite.
Internet Explorer has gradually been put aside by Microsoft, which prefers Edge. This is a reboot of the American company in the browser market, with a more modern and better maintained solution. This Microsoft Edge has itself evolved over time, as it has come to marry the same software base as Google Chrome, with the free Chromium web browser.
More generally, the days of Internet Explorer are numbered: the application must be removed from Windows 10 by June 2022. That being said, Microsoft indicated in its message that this uninstallation would not affect certain versions of the OS (those which are eligible for extended support), nor the MSHTML / Trident renderer. Moreover, bits of this component will be kept in Windows 11.