An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

This here being remote code execution vulnerability. Would somebody be kind enough to throw some light on this issue. I've never worked in the field of Information Security, so its a bit difficult for me to understand.

As Albert Einstein once said:“If you can't explain it to a six year old, you don't understand it yourself.” . Kindly explain it in that manner.

closed as unclear what you're asking by Adi, AJ Henderson, Iszi, Rory Alsop Apr 29 '14 at 17:31

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    As you'll see from questions we have had on the site regarding other vulnerabilities/attacks/bugs, you need to structure your post as a single question and follow the How to Ask page guidance. – Rory Alsop Apr 29 '14 at 17:33
  • Is that good enough or am I just going in the wrong direction? – Alok Apr 30 '14 at 4:05

On the page you linked you can find the CVE ID of the vulnerability: CVE-2014-1776. This is the most likely way different people will refer to the same vulnerability and nearly everyone talking about it will include this ID.

A search for that ID finds many people talking about it but the explanation from Symantec seems most suited to a 6-year-old.

FireEye (who are credited with the discovery of the vulnerability) have a more detailed write up.

It's probably worth clarifying the distinction that this isn't just a bug that has been discovered but rather it's an active exploit that has been in use by malicious actors for some time. FireEye discovered the attackers and by analysing what the attackers were doing, figured out the vulnerability and reported it to Micrososft. The vulnerability is the same no matter how it was discovered but the risk is much greater because there are already people exploiting it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.