Another internet vulnerability, “Zero Day” vulnerability discovered by security company FireEye.
This time with Windows Internet Explorer the browser that over 50% of the world's internet users browse the internet with.
Microsoft's Security Response Centre released a Security Advisory claiming "At this time, we are only aware of limited, targeted attacks. This issue allows remote code execution if users visit a malicious website with an affected browser. This would typically occur by an attacker convincing someone to click a link in an email or instant message."
In it's own blog, FireEye goes on the say that the vulnerability affects Internet Explorer versions 6 thru 11, incusive and explain serveral examples of attack.
FireEye goes on to say "The APT group responsible for this exploit has been the first group to have access to a select number of browser-based 0-day exploits (e.g. IE, Firefox, and Flash) in the past. They are extremely proficient at lateral movement and are difficult to track, as they typically do not reuse command and control infrastructure."
Enhanced Protected Mode in IE breaks the exploit in FireEye tests. EPM was introduced in IE10. Additionally, the attack will not work without Adobe Flash. Disabling the Flash plugin within IE will prevent the exploit from functioning.