Code posted for new IE attack

Hackers have posted attack code for a new vulnerability in Internet Explorer.

Hackers have discovered a new vulnerability in Internet Explorer, and they've released code that could be used to attack users of Microsoft's popular browser.

The vulnerability is similar to a bug that Microsoft patched last month in a multimedia component of Internet Explorer, according to Vincent Hwang, a group product manager with Symantec's Security Response team.

Though a sample exploit of the vulnerability was posted Wednesday by hackers on the xsec.org Web site, Symantec has yet to see the code used in any attacks, according to Hwang.

To take advantage of the exploit code, attackers would first need to trick users into viewing a maliciously encoded Web page, but they could then run unauthorized code on a victim's computer.

It is unclear right now which versions of Windows and Internet Explorer are affected by the vulnerability. Researchers at Secunia said they were able to create a "fully working" exploit for the latest version of Windows XP running Internet Explorer 6. Windows 2000 users are also vulnerable, Secunia said.

Microsoft security researchers were unavailable to comment on the issue, but a spokesman for the company's public relations agency said that the matter was under investigation.

Symantec calls the bug "critical," and Secunia rates the issue as "highly critical," its most severe rating. The Secunia alert can be found here: http://secunia.com/advisories/21910/.

The xsec.org hackers referred to their code as a 0day, meaning an exploit for a previously undisclosed vulnerability. But one well-known hacker said the flaw was not difficult to find using publicly available security tools, such as the AxMan ActiveX fuzzing software.

"Calling it 0day is a stretch," said HD Moore, the head of the Metasploit project, via e-mail.

Moore wrote an automated ActiveX testing tool called AxMan that uncovered a handful of IE bugs, including the one exploited by on xsec.org. Although Moore recently launched a project called the Month of Browser Bugs, in which he disclosed a new browser vulnerability every day for the month of July, he said he had refrained from disclosing this particular vulnerability.

"This is one of the many exploitable bugs that can be discovered using AxMan and one of the few that I didn't include in Month of Browser bugs due to the ease of exploitation," he said. "I still have three or four left in IE that have similar impact."

This is the second unpatched flaw that Microsoft is looking at patching right now. Earlier this month, attackers began exploiting a vulnerability in the company's Word software.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Bitdefender 2019

Bitdefender solutions stop attacks before they even begin! Get cybersecurity that 500 MILLION users already have and trust.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?