Exploit Code Targets Internet Explorer Zero-Day

There's exploit code circulating that can be used to target certain versions of Internet Explorer, Microsoft says it's working on a fix.In Security Advisory 977981 Microsoft acknowledged Internet Explorer 6 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6 and Internet Explorer 7 on supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 is vulnerable to a remote code execution attack.

Fortunately, Microsoft Internet Explorer 5.01 Service Pack 4 and Internet Explorer 8 on all supported versions of Microsoft Windows are not affected.

The flaw makes it possible to exploit how Internet Explorer handles cascading style sheet (CSS) information. And, currently, while the vulnerability theoretically makes it possible for attackers to run attack code on victim's machines, it's not yet an easy attack, according to this post from security firm Symantec:

The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future. When this happens, attackers will have the ability to insert the exploit into Web sites, infecting potential visitors. For an attacker to launch a successful attack, they must lure victims to their malicious Web page or a Web site they have compromised. In both cases, the attack requires JavaScript to exploit Internet Explorer.

With all of the online transactions expected to take place during the next few weeks, attackers will be angling for any edge they can get to infiltrate systems and grab credit card data. So expect fully functional exploit code to come quickly.

If you haven't already done so, it may be a good time to turn off JavaScript and upgrade to Internet Explorer 8.