Feeds

Microsoft flings out emergency patch for Iatest gaping IE hole

Monday 'fun' for sysadmins

Reducing security risks from open source software

Microsoft has announced plans to release an out-of-band patch today tackling a critical zero-day hole in Internet Explorer.

The update will almost certainly tackle an unpatched remote-code execution flaw in earlier versions of IE (detailed in Microsoft Security Advisory 2794220) that has become the target of hacker attacks since late December.

For now, Redmond only says the flaw is critical, as per its standard practice of not going into details ahead of actually publishing a security patch. Microsoft advises customers to apply the critical patch immediately, a piece of advice echoed by security watchers such as Sophos.

Several websites have already been compromised to spread malware exploits based on the vulnerability in IE 6,7 and 8. Users could safeguard themselves by either updating to IE 9 and 10 or using an alternative browser. Microsoft published a temporary FixIt tool to protect against this vulnerability but security researchers found this defence was far from bullet-proof.

IE 9 has been available since March 2011. Although the vulnerability attacks old, arguably obsolete browser software, it still presents a huge risk - not least because it affects 90 per cent of the Internet Explorer installed base, according to cloud security firm Qualys.

Sites booby-trapped to serve exploits based on the attack include an Iranian oil company, a website serving the Uyghur people of East Turkistan, the Council on Foreign Relations website and others.

The attacks bear the hallmarks of previous infections spread by the so-called Elderwood Project. Although a different vulnerability was abused in those earlier attacks, the ultimate aim was geared towards delivering the same malicious payload.

Emergency (out-of-sequence) patches for security flaws in Microsoft software are a rare but far from unprecedented occurrence. Previous examples include a fix for a security bug in ASP.Net applications that allowed attackers to decrypt password files, cookies, and other sensitive data in September 2010. You might also recall the August 2010 patch for a flaw in Windows shortcut, also associated with malware attack, and a March 2010 update to tackle a security bug in IE, also linked with distributing malware.

Patches outside the regular Patch Tuesday update are a pain for administrators and Redmond has done a good job in cutting down their frequency over the last three or four years. Microsoft has been battle-hardened from years of combating Windows bugs and its security practices have become an example to the rest of the industry. Some also argue that it encourages hackers to divert their attention away from Redmond and towards exploiting vulnerabilities in third-party software, most particularly Java and Adobe applications. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.