Microsoft confirms IE flaw, not yet being exploited

Share this article:

Microsoft has confirmed the presence of an unpatched vulnerability in all supported versions of its Internet Explorer (IE) browser.

The software giant on Tuesday evening EST released a security advisory, acknowledging the flaw that, if exploited, could result in the execution of remote code. The bug impacts IE versions 6, 7 and 8.

"The vulnerability exists due to the creation of uninitialized memory during a CSS [style sheets] function within Internet Explorer," the advisory said. Users can be exploited if they visit a web page hosting the exploit.

Microsoft is not aware of any in-the-wild attacks targeting the vulnerability or of any affected customers, Carlene Chmaj, senior response communications manager for Microsoft's Trustworthy Computing group, said in a blog post.

But proof-of-concept code exists. A video demonstrating code execution was posted Monday by Offensive Security, a provider of security tools and training. And on Wednesday, exploit code was published as part of the open-source Metasploit hacking toolkit.

Although the flaw is able to bypass two built-in Windows security features, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), IE Protected Mode for Vista and subsequent versions of Windows "helps to limit the impact of currently known proof-of-concept exploits," Chmaj wrote.

Microsoft is next due to release security fixes on Jan. 11. As of now, the company has no plans to issue an out-of-cycle patch for this vulnerability.

"However, we are monitoring the threat landscape very closely," Chmaj wrote.

Share this article:

Sign up to our newsletters

More in News

In Cisco probe, misuse or compromise spotted on all firms' networks

In Cisco probe, misuse or compromise spotted on ...

Cisco analyzed the business networks of 30 multinational companies last year, and revealed the findings in its 2014 Annual Security Report.

Fareit trojan observed spreading Necurs, Zbot and CryptoLocker

The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit.

Post Heartbleed, tech giants join initiative to bolster open source

Post Heartbleed, tech giants join initiative to bolster ...

The newly formed Core Infrastructure Initiative, created to boost under-funded open source projects, will tackle OpenSSL first.