Microsoft on Monday issued a security advisory that confirmed in-the-wild attacks are exploiting an unpatched bug in Internet Explorer. The software maker is working on a fix.
The advisory addressed the "zero-day" vulnerability -- meaning it was discovered and exploited before a patch was available -- that was found and disclosed by researcher Eric Romang over the weekend. On Monday, the Metasploit open-source penetration framework published an exploit module for the bug, putting pressure on Microsoft to act quickly.
[ Also on InfoWorld: Google to drop support for IE8 on Nov. 15. | Get ready for Windows 8 with the Windows 8 Deep Dive PDF special report, which explains the new direction for Windows, the Metro interface for tablet and desktop apps, the transition from Windows 7, and more. | Stay atop key Microsoft technologies in our Technology: Microsoft newsletter. ]
"We have received reports of only a small number of targeted attacks and are working to develop asecurity update to address this issue," said Yunsun Wee, director of Microsoft's Trustworthy Computing group, in a post to the Microsoft Security Response Center blog.
All but one supported edition of IE are affected: 2001's IE6, 2006's IE7, 2009's IE8 and last year's IE9. Together, those browsers accounted for 53 percent of all browsers used worldwide in August. The only exception was IE10, the browser bundled with the new Windows 8, which does not contain the bug.
Monday's advisory was expected, said Andrew Storms, director of security operations at nCircle Security. "I think they had to get it out today," said Storms late Monday in an interview over instant messaging. "Too many people watching and waiting for something official."
Earlier Monday, Microsoft acknowledged that it was investigating reports of a vulnerability but did not promise a patch. The bug, when Microsoft gets around to patching it, will be rated "critical," the company's highest threat ranking. Exploiting the flaw allows hackers to execute code -- in other words, plant malware on a machine -- and opens Windows XP, Vista and Windows 7 to drive-by attacks that only require getting victims to visit a malicious or compromised website.
Until a patch is available, Microsoft recommended that users block attacks with EMET 3.0 (Exploit Mitigation Experience Toolkit), boosting IE's security zone settings to "high," and configuring the browser to display a warning before executing scripts. EMET is a tool designed for advanced users, primarily enterprise IT professionals, that manually enables anti-exploit technologies such as ASLR (address space layout randomization) and DEP (data execution prevention) for specific applications.
But not everyone agreed that EMET was the answer.
Read more: http://www.infoworld.com/d/security/microsoft-confirms-hackers-exploiting-critical-ie-bug-promises-patch-202590
No comments:
Post a Comment