Emergency Internet Explorer patch issued

Share this article:
As promised, Microsoft on Wednesday issued an out-of-band emergency fix for Internet Explorer (IE) to patch a security vulnerability that affects all supported versions of Microsoft's web browser.

The vulnerability involves a data-binding issue and is currently being exploited in the wild -- distributed via SQL injection, according to the SANS Internet Storm Center (ISC) in a post.

“Microsoft's latest IE out-of-band patch release needs to be installed right away,” Eric Schultze, CTO of Shavlik Technologies, wrote in an email to SCMagazineUS.com on Wednesday. “The number of infected websites is growing at an alarming rate -- even people visiting legitimate websites are getting hacked with this exploit.”

The vulnerability was announced last week and over the weekend exploits gained momentum. There have been SQL injections on about 6,000 websites. The injected code leads to the download of a trojan that modifies files on an infected user's PC and downloads other malicious files.

"The important thing to note about this IE flaw is not the flaw itself, but how rapidly attackers were able to push this out to compromised web applications," Billy Hoffman, manager at the HP Web Security Research Group in an email to SCMagazineUS.com. "This was because the hackers have an existing infrastructure of hacked sites and can very rapidly update the malware they serve."

Another exploit aiming to steal information from Chinese online gamers was identified, TrendLabs said in a blog post Wednesday.

"Microsoft played down the issue on Patch Tuesday, but by the end of the week we in the security community had proven in our own labs that it was not just an IE 7 issue, and, in fact, it impacted multiple versions of IE -- even beta Version 8 – across multiple MS operating systems," Paul Henry, forensic analyst at Lumension Security, said in an email to SCMagazineUS.com on Wednesday.

Shavlik said Microsoft probably decided the issue warranted an out-of-band patch based on the rapid rate of user infection and because attackers were loading the exploit on legitimate websites so users who visit seemingly innocent websites might also be hit.

"The underlying exploit was actively being used in the wild and damage was mounting," Henry said.

Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.