New hacker peril for older IE versions
New species of unpatched bug bites IE6 and 7
Posted in Applications, 23rd November 2009 11:19 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Internet Explorer users are at risk from a newly discovered and unpatched vulnerability in older versions of Microsoft's browser.
A security flaw involving a dangling pointer in Microsoft's HTML Viewer (mshtml.dll) creates a possible mechanism for hackers to crash the browser and inject malware, providing they can trick marks into visiting maliciously constructed sites designed to exploit the vulnerability. Poor reliability exploits targeting the flaw were posted on underground websites late last week. Better quality attacks are more than likely to follow.
Tests by Symantec have confirmed the 0-day flaw affects Internet Explorer 6 and 7. IE8 users are reckoned to be in the clear.
Surfers using older versions of IE (why the heck is anyone still using IE6 anyway?) are advised to disable JavaScript and to stay away from untrusted websites. Alternatively they could upgrade to IE8 or use an alternative browser instead.
More on the threat can be found in a write-up by the SAN Institute's Internet Storm Centre here. ®
Send corrections
Data control in the cloud
The new Office Garage series:
Enabling efficient data center monitoring
Top 10 SIEM implementer’s checklist
