IE flaw worse than originally thought

Powered by SC Magazine
 

Microsoft has confirmed that it is not just Internet Explorer (IE) 7 that is vulnerable to a new zero day attack, but older versions of the browser too.

IE 5 and 6 have been confirmed as also vulnerable to the flaw which, when properly exploited, can allow a hacker to gain complete control of a vulnerable system.

“At this time, we are aware only of limited attacks that attempt to use this vulnerability against Windows Internet Explorer 7,” said the company in an advisory.

“Our investigation of these attacks so far has verified that they are not successful against customers who have applied the workarounds listed in this advisory. Additionally, there are mitigations that increase the difficulty of exploiting this vulnerability.”

The flaw targets a component in IE7 that handles XML tags. When the page confirms that the user is running a vulnerable browser and operating system, a specially crafted tag is loaded.

“Any security vendor basing their detection rules on the publicly available exploits is not detecting attacks fully,” said Carsten Eiram, chief security specialist at Secunia.

“Users should therefore not just browse around using their IE browser, thinking that they're safe. Setting the security level to "High" for the "Internet" security zone will somewhat protect you and combined with Microsoft's suggestions related to OLEDB32.DLL you should be able to keep your system to yourself.”

Copyright ©v3.co.uk


IE flaw worse than originally thought
 
 
 
Top Stories
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
What InfoSec can learn from the insurance industry
[Blog post] Another way data breach laws could help manage risk.
 
A ten-point plan for disrupting security
[Blog post] How can you defend the perimeter when it’s in the cloud?
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  21%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1045

Vote