New attack targets weakness in Internet Explorer
Blueprints showing attackers how to exploit a previously unknown security hole in versions of Microsoft's Internet Explorer browser recently were published online. The danger here is if IE users browse to a hacked or booby-trapped Web site that uses the exploit, that site could install malicious software.
Microsoft has not yet issued an advisory about this threat. According to initial reports from Symantec and vulnerability management firm VUPEN, the exploit works against IE 6 and IE 7 versions only. The vulnerability apparently resides in the way IE handles so-called cascading style sheet information (CSS), which a great many Web sites use to control the design and formatting of text and other site elements.
But as I've noted frequently, the advice to avoid untrusted Web sites is a tad hollow in a world in which a fair percentage of the malicious sites out there are legitimate sites that have been hacked or otherwise compromised. Consider what would happen if a tainted banner ad containing this exploit were to run on a series of high-traffic Web sites (a la the bad ads that ran on the New York Times' site earlier this year).
Now might be an excellent time for diehard IE users to either upgrade to IE8, or to try out another browser, such as Firefox or Opera. Firefox, combined with either the Noscript or Request Policy add-ons, goes a long way toward helping users insulate themselves from these types of malicious scripting attacks.
Update, 10:55 p.m. ET: Microsoft issued an advisory about this flaw, available here. Redmond says the vulnerability affects Internet Explorer 6 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6 and Internet Explorer 7 on supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.
November 23, 2009; 10:59 AM ET
Categories: Latest Warnings , Safety Tips | Tags: 0day, ie
Save & Share: Previous: Alpha Software disclosure leads to confusion
Next: Spam 'Godfather' gets 51 months in prison
Posted by: SilverSpring8 | November 23, 2009 1:41 PM | Report abuse
Posted by: Rixstep | November 23, 2009 2:57 PM | Report abuse
Posted by: GWGOLDB | November 23, 2009 3:00 PM | Report abuse
Posted by: pj48 | November 23, 2009 10:53 PM | Report abuse
Posted by: firstname.lastname@example.org | November 23, 2009 11:03 PM | Report abuse
Posted by: Yeziam | November 24, 2009 5:51 AM | Report abuse
Posted by: dalkorian | November 24, 2009 1:02 PM | Report abuse
Posted by: mhenriday | November 24, 2009 5:02 PM | Report abuse
Posted by: mczonkwa1 | November 26, 2009 4:08 AM | Report abuse
The comments to this entry are closed.