Internet Explorer 8 "critical" flaw in final version

Share this article:

The Internet Explorer 8 (IE8) vulnerability demonstrated last week at the CanSecWest hacker conference In the beta version of the popular web browser also exists in the final version.

Microsoft confirmed that the vulnerability exists in the official release, said Terri Forslof, a researcher at TippingPoint, which sponsored the Pwn2Own contest that challenged competitors to find bugs in either web browsers or mobile devices.

No details of the IE8 exploit -- discovered Wednesday by the hacker "Nils" -- are available, but it could represent a major problem, Forslof said.

“This is a single-click-and-you're-owned exploit,” she told SCMagazineUS.com on Tuesday. “You click a link in an email or simply browse to a website, and your machine is compromised. This meets Microsoft's ‘critical' bar [in its vulnerabilities and rating system].”

The exploit was demonstrated the day before the final version of IE8 was released on Thursday.

“Once the browser was compromised, we handed over the exploit to Microsoft immediately, on site," Forslof said. "They went back and reproduced it and called to verify that the vulnerability was present. We retested again on the released version of IE8 that went live on the following morning and verified that the vulnerability was in it as well.”

The exploit apparently defies Microsoft's DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) technologies -- two features added to IE8 to prevent memory corruption vulnerabilities.

For its part, Microsoft said in a Monday blog post: “The final release of Internet Explorer 8 on Windows Vista blocks the .NET DEP+ASLR bypass mechanism from malicious websites on the internet. But this post may have been more specifically referring to different bypass mechanisms that were demonstrated by a pair of researchers at last year's Black Hat conference in Las Vegas.

In addition, the Microsoft post only mentions Vista. The CanSecWest exploit was demonstrated using a beta version of Windows 7, which may call the issue into question.

A Microsoft spokeswoman said Microsoft was aware of the flaw and was investigating. It had not received any reports of public exploits, the spokeswoman said.

Share this article:
You must be a registered member of SC Magazine to post a comment.
close

Next Article in News

Sign up to our newsletters

TOP COMMENTS

More in News

Information sharing requires breaking down barriers, White House cyber guru says

Information sharing requires breaking down barriers, White House ...

The White House has advanced an agenda to promote and facilitate information sharing on security threats and vulnerabilities.

Worm variant of Android ransomware, Koler, spreads via SMS

Worm variant of Android ransomware, Koler, spreads via ...

Upon infection, the Koler variant will send an SMS message to all contacts in the device's address book.

Patch for Windows flaw can be bypassed, prompts temporary fix from Microsoft

Patch for Windows flaw can be bypassed, prompts ...

The Windows zero-day received a patch last week, but the fix can still be bypassed by crafty attackers.