MS warns over zero-day IE bug
Exploit circumvents added security defences
Customer Success Testimonial: Recovery is Everything
Microsoft warned on Wednesday of a new zero-day vulnerability in Internet Explorer.
The flaw creates a means for hackers to inject malware onto vulnerable systems, providing surfers are first tricked into visiting booby-trapped websites. As such the flaw poses a severe drive-by download risk.
All established version of IE (from 6 to 8) are affected. It's unclear whether or not the IE 9 beta is similarly vulnerable. The flaw reportedly involves the handling of Cascading Style Sheets by Microsoft's browser software. The bug first came to light on the seclists.org full disclosure mailing list earlier this month.
A module exploiting the bug – which is noteworthy because it defeats Data Execution Prevention (DEP) and Address Space Layout Randomisation (ASLR) security defences in Microsoft products – has been added by the Metasploit project.
No patch is available but Redmond has published an advisory explaining how to mitigate against possible attack.
A more detailed discussion of the flaw can be found in a blog post by Paul Duckin of Sophos here. ®
COMMENTS
CIO Perspective
We will be applying new Microsoft patches to all our desktop computers to enhance the security of Internet Explorer 6. Please be aware of corporate policy not to attempt to install unauthorised third party browsers. Non-MIcrosoft browsers are not supported by our IT team or by Microsoft.
Please refrain from using sites, developed by trendy web designers, known to have issues with IE6, such as Facebook or Google Maps. PLease use Microsoft services instead.
Well...
Not *technically* a security bug in Calculator, but there is a security escalation vulnerability in the Help file for Calculator that in some versions of Windows can be used to open a command prompt or execute other applications that a limited user account is otherwise barred from executing.
So we have to use what to update MS
So we have to use IE to update a known flaw in IE !
until we can update MS programs without having to be tied into IE, and forced to have it installed on our machine, then what do we expect.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
