Exploit Code Targets Internet Explorer Zero-Day
There's exploit code circulating that can be used to target certain versions of Internet Explorer, Microsoft says it's working on a fix.
November 24, 2009
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
There's exploit code circulating that can be used to target certain versions of Internet Explorer, Microsoft says it's working on a fix.In Security Advisory 977981 Microsoft acknowledged Internet Explorer 6 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6 and Internet Explorer 7 on supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 is vulnerable to a remote code execution attack.
Fortunately, Microsoft Internet Explorer 5.01 Service Pack 4 and Internet Explorer 8 on all supported versions of Microsoft Windows are not affected.
The flaw makes it possible to exploit how Internet Explorer handles cascading style sheet (CSS) information. And, currently, while the vulnerability theoretically makes it possible for attackers to run attack code on victim's machines, it's not yet an easy attack, according to this post from security firm Symantec:
"The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future. When this happens, attackers will have the ability to insert the exploit into Web sites, infecting potential visitors. For an attacker to launch a successful attack, they must lure victims to their malicious Web page or a Web site they have compromised. In both cases, the attack requires JavaScript to exploit Internet Explorer."
With all of the online transactions expected to take place during the next few weeks, attackers will be angling for any edge they can get to infiltrate systems and grab credit card data. So expect fully functional exploit code to come quickly.
If you haven't already done so, it may be a good time to turn off JavaScript and upgrade to Internet Explorer 8.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024