IE zero-day danger growing
Large numbers of users vulnerable to unpatched problem.
The as-yet unpatched vulnerability in Microsoft's Internet Explorer browser,
reported last week and coinciding with the release of the monthly
'Patch Tuesday' security updates, is becoming more serious by the day as more and more infected websites appear to
be attempting to exploit the flaw to gain access to visitors' systems.
The vulnerability was thought only to affect IE7 when first discovered, and was being exploited only by
limited numbers of targeted trojans. Since then, attacks via the vulnerability have been shown to work on a wide
range of Windows and IE variants, and have been widely seeded to both malicious websites and legitimate
sites that have been compromised to display malicious content.
A blog post
issued by Microsoft on Saturday claimed a 50% rise in attacks spotted in the previous 24 hours, with as many as
0.2% of all web users exposed to the threat. The same day, Trend Micro researchers
reckoned that some
6,000 web pages were playing host to exploits targeting the vulnerability. Numbers are thought to have climbed rapidly
since then.
Technical details of the vulnerability, including affected systems and possible workarounds, are in the updated advisory
from Microsoft, here, or in
vulnerability reporting systems at Secunia,
US-CERT and
Sophos. More coverage is in blog
posts from F-Secure, Sophos
here and
here, from SANS
here, and in the Washington Post
here.
16 December 2008
Tags:
exploit, internet explorer, microsoft, patch, patch tuesday, vulnerability.
del.icio.us 
digg this
0 comments
Comments are closed.
