Exploit code posted for new Internet Explorer flaw

Share this article:

An exploit taking advantage of an unpatched vulnerability in Internet Explorer (IE) has gone public.

Security researcher Shahin Ramezany said in a Tuesday tweet that he was able to exploit the flaw, which involves the way IE handles CSS style sheets on Windows 7 and Vista machines.

A video demonstrating code execution was posted Monday by Offensive Security, a provider of security tools and training.

On Wednesday, exploit code was published as part of the open-source Metasploit hacking toolkit.

The flaw is able to bypass two built-in Windows security features: Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), according to Ramezany.

Microsoft has not yet confirmed the vulnerability.

"We're currently unaware of any attacks trying to use the claimed vulnerability or of customer impact," Dave Forstrom, director of trustworthy computing at Microsoft, told SCMagazineUS.com on Wednesday in an email. "Once we're done investigating, we will take appropriate action to help protect customers."



Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.