'Treasure Hunt' Leads to Release of Zero-Day Attack
Researcher unleashes Internet Explorer proof-of-concept attack after holding a contest for readers to find the code on his blog page
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Game over: A researcher who embedded a zero-day proof of concept for Internet Explorer in his blog last week has released details on the attack, which affects IE 7.0 as well as IE 8.0 (beta) browsers running on Windows XP.
Aviv Raff yesterday in his blog detailed the proof-of-concept attack on a cross-zone scripting vulnerability he had discovered in IE that lets an attacker run code on a user’s machine each time the victim prints a Web page with the “Print Table of Links” feature. This feature lets users include in a Web page printout a list of links on that page. Raff had challenged readers of his blog to find the zero-day exploit on his site on May 7.
Security experts don’t consider the new vulnerability critical, but it can do some damage. “An attacker can easily add a specially crafted link to a webpage (e.g. at his own website, comments in blogs, social networks, Wikipedia, etc.), so whenever a user will print this webpage with this feature enabled, the attacker will be able to run arbitrary code on the user’s machine (i.e. in order to take control over the machine),” Raff wrote in his blog post yesterday.
The bug affects IE 7 and 8.0 beta on a patched XP machine, and partially affects Windows Vista with user access control turned on, according to Raff. Earlier versions of IE may also be prone to the attack, he said.
Raff said he alerted Microsoft to the bug last week. “Their last response was that they are looking at an appropriate fix,” he wrote. In the meantime, he recommends users don’t deploy the “print table of links” feature when they print a Web page. Raff has posted a live POC of the browser attack at milw0rm.
— Kelly Jackson Higgins, Senior Editor, Dark Reading
Microsoft Corp. (Nasdaq: MSFT)
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024