Exploit code posted for new Internet Explorer flaw

Share this article:

An exploit taking advantage of an unpatched vulnerability in Internet Explorer (IE) has gone public.

Security researcher Shahin Ramezany said in a Tuesday tweet that he was able to exploit the flaw, which involves the way IE handles CSS style sheets on Windows 7 and Vista machines.

A video demonstrating code execution was posted Monday by Offensive Security, a provider of security tools and training.

On Wednesday, exploit code was published as part of the open-source Metasploit hacking toolkit.

The flaw is able to bypass two built-in Windows security features: Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), according to Ramezany.

Microsoft has not yet confirmed the vulnerability.

"We're currently unaware of any attacks trying to use the claimed vulnerability or of customer impact," Dave Forstrom, director of trustworthy computing at Microsoft, told SCMagazineUS.com on Wednesday in an email. "Once we're done investigating, we will take appropriate action to help protect customers."



Share this article:

Sign up to our newsletters

More in News

In Cisco probe, misuse or compromise spotted on all firms' networks

In Cisco probe, misuse or compromise spotted on ...

Cisco analyzed the business networks of 30 multinational companies last year, and revealed the findings in its 2014 Annual Security Report.

Fareit trojan observed spreading Necurs, Zbot and CryptoLocker

The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit.

Post Heartbleed, tech giants join initiative to bolster open source

Post Heartbleed, tech giants join initiative to bolster ...

The newly formed Core Infrastructure Initiative, created to boost under-funded open source projects, will tackle OpenSSL first.