Feeds

'Critical' IE bug threatens PC users

Oh dear, it's been a bad week

Beginner's guide to SSL certificates

A dangerous new exploit in Internet Explorer could put PCs and data at risk, Microsoft has admitted.

The flaw, for which code has already been published on the internet, could be exploited to set an email-borne virus free on the unsuspecting public.

Potential viruses could come as an attachment that conceals the code, or could possibly redirect users to a site that will unleash the code on the user's machine, leaving the computer open to remote attack. Once the PC is being controlled by a malicious user, it can then be used to launch attacks on other PCs.

Even supposedly fully patched versions of Internet Explorer 6 are vulnerable to the flaw, it seems, as are users with XP Service Pack 2.

However, Microsoft has no plans to patch it until its next security update is released. This is despite some security companies rating it as a high level threat.

In a security advisory on its website, Microsoft outlined the threat: "We have seen examples of proof of concept code but we are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.

"Microsoft has determined that an attacker who exploits this vulnerability would have no way to force users to visit a malicious website."

Instead, it has warned users of its browser products to be careful when opening email attachments and to avoid untrusted websites. It has also recommended that users disable Active Scripting in their browser in an attempt to reduce their exposure to attack.

The other option is to choose an alternative browser, such as Firefox or Opera. However, even these browsers are not as safe from attack as they were once considered.

Firefox has been subject to a number of flaws over the past year, including one that could leave its users more vulnerable to phishing scams. Meanwhile, a report published in September by Symantec rated Internet Explorer as safer than Firefox. The report found some 25 flaws in Mozilla's Firefox internet browser, almost double the number it discovered in IE.

However, it has been a tough week for Microsoft - this is the third security flaw it has had to investigate in the past seven days. On Tuesday, it admitted it was looking into a security flaw that could leave Windows PCs open to remote control, while earlier in the week it also alerted users to a vulnerability that could cause the Internet Explorer browser to crash.

Copyright © 2006, ENN

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.