New zero-day IE exploit on the loose

By

Vulnerability could allow hackers to execute arbitrary code.

Internet Explorer is reeling from yet another zero-day exploit, this time causing the browser to crash or tricking users into visiting a malicious web page.

The new exploit, which was published to the BugTraq mailing list at the weekend, affects Internet Explorer 6 and 7, according to Symantec researchers.

Symantec said that the malware exhibits signs of "poor reliability", but that a "fully-functional reliable exploit" is likely to be available soon.

The issue is caused by a memory corruption error in the Microsoft HTML Viewer when retrieving certain CSS/STYLE objects, explained researchers from vulnerability research firm Vupen Security in a security advisory.

This could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious web page, the firm added.

Symantec said in a blog post that a successful attack would require the attacker to "lure victims to their malicious web page or a web site they have compromised".

"To minimise the chances of being affected by this issue, Internet Explorer users should ensure their anti-virus definitions are up to date, disable JavaScript and only visit web sites they trust until fixes are available from Microsoft."

New zero-day IE exploit on the loose
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

China blamed after cyberattack hits Czech Republic

China blamed after cyberattack hits Czech Republic

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?