Feeds

MS mulls emergency IE fix

Out-of-band

The essential guide to IT transformation

Microsoft is considering plans to release an unscheduled security patch to address a serious security vulnerability in its ubiquitous Internet Explorer web browser.

Malicious hackers are taking advantage of a security bug in the Vector Markup Language (VML) component of IE to infect users visiting specific pornographic, or other maliciously constructed websites.

Opening maliciously constructed emails in Outlook is also a potential risk, especially as attacks targeting the vulnerability are growing in prevalence since their first appearance last week.

Security firms report the increased prevalence of mass mailing lures that attempt to direct surfers to websites hosting VML exploit code, using tricks such as claiming users have received a Yahoo! Greeting Card.

Microsoft, contrary to reports from independent security experts such as the SANS Institute, claims that these attacks remain "limited". But it concedes this situation could change at any time.

In response, Microsoft is pushing hard to develop and test a stable security patch. This patch is nearing sign-off and may be ready for release outside Microsoft's regular Patch Tuesday update cycle, a rare but far from unprecedented move. Microsoft's next Patch Tuesday is due on 10 October, but the IE patch is likely to appear before that, if a posting on Microsoft's Security Response blog is anything to go by.

"We've made some progress in our testing pass for the update and are now evaluating releasing this outside the monthly cycle, as we do any time customers are under threat and we believe we can issue an update that meets our quality bar for widespread deployment. So right now we're looking at where we hit that quality bar and if that occurs prior to the monthly cycle then we will release," writes Microsoft's Scott Deacon. "The primary driver here is quality and protecting customers, not adherence to the monthly schedule."

News of the possibility of an official IE patch from Microsoft comes days after the release of an unofficial patch from a new ad-hoc group of security pros, called the Zeroday Emergency Response Team (ZERT). Microsoft said it welcomes this work, but does not endorse third party updates on general principle. "As a best practice, customers should obtain security updates and guidance from the original software vendor," Deacon writes.

The VML security bug is unrelated to a (still unpatched) flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control discovered earlier this month. It's unclear when Microsoft will fix this bug and a patch for this may, or may not, come later than that for the VML bug. ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?