Original URL: http://www.theregister.co.uk/2006/09/18/ie_flaw_warnings_grow/
Warnings grow over unpatched IE flaw
Stop us if you've heard this before
Posted in Enterprise Security, 18th September 2006 15:43 GMT
Free whitepaper – Dell PowerEdge server benchmarks
Security experts warn a new, unpatched vulnerability in Internet Explorer might be used to spread malware. A flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control, rated as critical (http://secunia.com/advisories/21910) by Secunia and other security watchers, has spawned (http://www.symantec.com/enterprise/security_response/weblog/2006/09/new_internet_explorer_0day_vul.html) proof of concept code but has not yet become the subject of widespread, hostile attack. Memory corruption is possible (http://www.frsirt.com/english/advisories/2006/3593) even on a fully patched Windows XP system.
A patch is unlikely until next month's Patch Tuesday update. Microsoft said it was investigating (http://www.microsoft.com/technet/security/advisory/925444.mspx) the problem. Surfers are advised to restrict which sites they allow to run ActiveX controls or here (http://www.us-cert.gov/cas/alerts/SA06-258A.html) ActiveX controls altogether. Tech-savvy IE users might try a workaround from the SANS Institutes's Internet Storm Centre, as explained here (http://isc.sans.org/diary.php?storyid=1706). A simpler solution, at least until Microsoft releases a patch, might be to use Firefox, Opera or all any other alternative browser. ®