Microsoft confirms IE flaw, not yet being exploited

Share this article:

Microsoft has confirmed the presence of an unpatched vulnerability in all supported versions of its Internet Explorer (IE) browser.

The software giant on Tuesday evening EST released a security advisory, acknowledging the flaw that, if exploited, could result in the execution of remote code. The bug impacts IE versions 6, 7 and 8.

"The vulnerability exists due to the creation of uninitialized memory during a CSS [style sheets] function within Internet Explorer," the advisory said. Users can be exploited if they visit a web page hosting the exploit.

Microsoft is not aware of any in-the-wild attacks targeting the vulnerability or of any affected customers, Carlene Chmaj, senior response communications manager for Microsoft's Trustworthy Computing group, said in a blog post.

But proof-of-concept code exists. A video demonstrating code execution was posted Monday by Offensive Security, a provider of security tools and training. And on Wednesday, exploit code was published as part of the open-source Metasploit hacking toolkit.

Although the flaw is able to bypass two built-in Windows security features, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), IE Protected Mode for Vista and subsequent versions of Windows "helps to limit the impact of currently known proof-of-concept exploits," Chmaj wrote.

Microsoft is next due to release security fixes on Jan. 11. As of now, the company has no plans to issue an out-of-cycle patch for this vulnerability.

"However, we are monitoring the threat landscape very closely," Chmaj wrote.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.