Microsoft will patch IE zero day but doesn't give timeline

Attackers are probably trying to develop exploit code, the CTO of Qualys says

Microsoft said Thursday it plans eventually to patch a vulnerability in Internet Explorer 8 that it's known about for seven months, but it didn't say when.

A security research group within Hewlett-Packard called the Zero Day Initiative (ZDI) released details of the flaw on Wednesday after giving Microsoft months to address it. The group withholds details of vulnerabilities to prevent tipping off hackers but eventually publicizes its findings even if a flaw isn't fixed.

Microsoft said it had not detected attacks that used the vulnerability, which is a "use-after-free" flaw, which involves the handling of CMarkup objects.

The company did not give a reason for the long delay but said in a statement that some patches take longer to engineer and that "we must test every one against a huge number of programs, applications and different configurations."

"We continue working to address this issue and will release a security update when ready in order to help protect customers," it said.

To exploit the flaw, an attacker would have to convince a user to visit a malicious website. If the attack were successful, a hacker would have the same rights as the victim on the computer and could run arbitrary code.

Microsoft's next patch release, known as "Patch Tuesday," is scheduled for June 10. It occasionally issues an emergency patch if a vulnerability is being widely used in attacks.

Wolfgang Kandek, CTO of Qualys, wrote that exploit developers are probably studying ZDI's advisory to try to develop an attack.

"We do not know how quickly an exploit will be released, but the remaining time to Patch Tuesday is not that long," he wrote.

The Belgian researcher who found the flaw, Peter Van Eeckhoutte, wrote on his blog on Thursday that although Microsoft has known of the bug for a long time, "I don't believe this is an indication that Microsoft is ignoring bug reports or doesn't care about security at all, so let's not exaggerate things."

"In fact, Microsoft is doing an excellent job in handling vulnerability reports, issuing patches and crediting researchers," he wrote. "But I would be really worried if the bug was actively being exploited and left unpatched for another 180 days."

In its advisory, ZDI recommended that users set the Internet security zone settings in IE 8 to "high," which blocks ActiveX controls and Active Scripting. Also, using Microsoft's Enhanced Mitigation Experience Toolkit (EMET) would provide more defense, it wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags MicrosoftHewlett-PackardpatchesExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Bitdefender 2019

Bitdefender’s best-in-class security solutions have been awarded Product of the Year. Get cybersecurity that 500 MILLION users already have and trust!

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?