Microsoft warns that IE zero-day vulnerability causes data leakage |
 |
By Robert Westervelt, News Editor, SearchSecurity.com
08 Feb 2010 | SearchSecurity.in |
|
|
Microsoft issued a new advisory late Wednesday, warning Internet Explorer (IE) users of the potential for data leakage as a result of new publicly disclosed IE zero-day vulnerabilities.
The IE vulnerabilities could result in information disclosure for users running any version of the browser on Windows XP or users who have disabled Internet Explorer Protected Mode. The software giant said it is unaware of any IE zero-day attacks targeting the vulnerabilities.
An attacker could target the hole by setting up a drive-by attack on a webpage. Microsoft said malicious code could also be served up in certain Web advertisements.
Until a patch is issued, a temporary Microsoft Fix-it (direct download) has been made available for Windows XP users. It automates Network Protocol Lockdown and can be deployed by enterprises through their automated systems, Microsoft said. In addition, Microsoft also provided a guide for system administrators describing manual steps for deploying the temporary network protocol fix.
Microsoft said users running IE 7 or 8 on Windows Vista and Windows 7 are not vulnerable to the flaw because the default configuration puts users in IE Protected Mode.
Danish vulnerability clearinghouse Secunia gave the IE zero-day vulnerability a "moderately critical" rating. Secunia said an error results when the browser incorrectly handles redirections bypassing domain restrictions. It results in disclosure of some local files. A second flaw results when the browser handles a "dynamically created object," also disclosing certain files.
"Successful exploitation of the vulnerabilities requires that the full path to a target file is known prior to the attack," Secunia said in its advisory.
Patch issued for corporate attacks targeting IE 6 users.
Microsoft issued an emergency, out-of-band update last month addressing eight vulnerabilities in Internet Explorer. The update was the result of high-profile, ongoing attacks targeting corporate users of IE 6 on Windows XP.
The attacks were carried out against Google, Adobe Systems Inc. and more than 30 other companies. Microsoft said all the vulnerabilities can lead to either information disclosure or enable an attacker to take complete control of a system.
|
