pixel_dreams - Fotolia

Microsoft re-releases EMET 5.2 to fix IE bug

Update: Microsoft has re-released Enhanced Mitigation Experience Toolkit version 5.2 to correct a bug involving IE 11.

Update: Microsoft has re-released the new version of its Enhanced Mitigation Experience Toolkit (EMET) after users reported that the update caused a serious bug in Internet Explorer (IE).

As an incremental update, EMET version 5.2 adds support for Control Flow Guard, which Microsoft introduced in Visual Studio 2015 to help detect and stop code-hijacking attempts.

There are also improvements to its Attack Surface Reduction mitigation capabilities, which would stop VBScript God Mode escalated privilege attacks, plus full support for alerting and reporting for Modern IE with Enhanced Protection Mode enabled.

Yet in various forums and message boards, users have reported that EMET 5.2 includes a major bug involving Internet Explorer 11 on Windows 8.1. Users are reporting that the EMET update causes IE 11 to become unstable and crash when attempting to navigate to a website.

According to a post on the Microsoft Technet forums by Eric Lawrence, former security program manager for IE at Microsoft, Microsoft has been made aware of the problem. Lawrence said that the fault for the issue is in the "certificate pinning" check, which Microsoft described as allowing users to create pinning rules for any SSL/TLS website certificate, and potentially detect man-in-the-middle attacks, which leverage untrusted certificates.

Lawrence said that disabling the certificate pinning check should fix the issue and  presents minimal risk for enterprises. Lawrence noted that certificate pinning is only a notification, so "users are not really protected" by it, but the EMET team is working on a fix now.

The software giant has long advocated use of its five-year-old tool as a reliable method for hardening Windows and other Microsoft applications against targeted attacks, particularly zero-day vulnerabilities. Microsoft launched EMET 5.0 at RSA Conference 2014.

Editor's note: This story was updated Tuesday, March 17, 2015, to note Microsoft's release of an updated version of EMET 5.2 that corrects the issue reported by users.

Executive Editor Eric Parizo contributed to this story.

Next Steps

Learn why Microsoft EMET is a useful security tool.

Dig Deeper on Microsoft Patch Tuesday and patch management