Microsoft warns that IE zero-day vulnerability causes data leakage
By Robert Westervelt, News Editor, SearchSecurity.com
08 Feb 2010 | searchSecurity.in
Microsoft issued a new advisory late Wednesday, warning Internet Explorer (IE) users of the potential for data leakage as a result of new publicly disclosed IE zero-day vulnerabilities.
The IE vulnerabilities could result in information disclosure for users running any version of the browser on Windows XP or users who have disabled Internet Explorer Protected Mode. The software giant said it is unaware of any IE zero-day attacks targeting the vulnerabilities.
An attacker could target the hole by setting up a drive-by attack on a webpage. Microsoft said malicious code could also be served up in certain Web advertisements.
Until a patch is issued, a temporary Microsoft Fix-it (direct download) has been made available for Windows XP users. It automates Network Protocol Lockdown and can be deployed by enterprises through their automated systems, Microsoft said. In addition, Microsoft also provided a guide for system administrators describing manual steps for deploying the temporary network protocol fix.
Microsoft said users running IE 7 or 8 on Windows Vista and Windows 7 are not vuln
Requires Membership to View
To gain access to this and all member only content, please provide the following information:
By joining searchSecurity.in you agree to receive email updates from the TechTarget network of sites, including updates on new content, magazine or event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile or unsubscribing via email.
TechTarget cares about your privacy. Read our Privacy Policy
erable to the flaw because the default configuration puts users in IE Protected Mode.
Danish vulnerability clearinghouse Secunia gave the IE zero-day vulnerability a "moderately critical" rating. Secunia said an error results when the browser incorrectly handles redirections bypassing domain restrictions. It results in disclosure of some local files. A second flaw results when the browser handles a "dynamically created object," also disclosing certain files.
"Successful exploitation of the vulnerabilities requires that the full path to a target file is known prior to the attack," Secunia said in its advisory.
Patch issued for corporate attacks targeting IE 6 users.
Microsoft issued an emergency, out-of-band update last month addressing eight vulnerabilities in Internet Explorer. The update was the result of high-profile, ongoing attacks targeting corporate users of IE 6 on Windows XP.
The attacks were carried out against Google, Adobe Systems Inc. and more than 30 other companies. Microsoft said all the vulnerabilities can lead to either information disclosure or enable an attacker to take complete control of a system.