Exploit Code Discovered for Unpatched IE Flaw

This week security researchers announced that exploit code taking advantage of an unpatched IE flaw has been published on the Web.

The code capitalizes on an IE error when encountering radio buttons using the "createTextRange()" method, allowing hackers to attack the visiting machine.

Microsoft issued a security advisory regarding the exploit Thursday.

"This vulnerability could allow an attacker to execute arbitrary code on the user's system in the security context of the logged-on user," a company spokesperson said. "Microsoft has determined that an attacker who exploits this vulnerability would have no way to force users to visit a malicious Web site… Instead, an attacker would have to persuade them to visit the Web site."

The advisory states that Redmond will decide soon whether to release a patch as part of its regular monthly schedule or provide an "out-of-cycle" security update.

Russ Cooper, director of risk intelligence publishing for the security firm Cybertust, said he doesn't think the exploit will warrant an out-of-cycle patch.

"What we have to look at is not the flaw and not the exploit code, but the actual risk to the user of being exploited by it," he commented. "The simple fact is that [these kinds of] exploits are not being abused in a way that affects a large group of people."

While many security research firms have rated the flaw "critical," Cooper countered that hackers' reliance on phishing e-mails for these types of attacks makes widespread infection extremely unlikely.

"People receive these e-mails multiple times a day, every day," he explained. "You're either duped by every one of them, or you don't go there."

"What security managers need to think about is whether [their] people are likely to stumble into the hole of these malicious sites. If they are, they've probably been infected already."

Cooper did say that a widespread outbreak could occur if hackers defaced popular Web sites with the code, but, historically, that scenario is extremely rare.

About the Author

Becky Nagel is the vice president of Web & Digital Strategy for 1105's Converge360 Group, where she oversees the front-end Web team and deals with all aspects of digital strategy. She also serves as executive editor of the group's media Web sites, and you'll even find her byline on, the group's newest site for enterprise developers working with AI. She recently gave a talk at a leading technical publishers conference about how changes in Web technology may impact publishers' bottom lines. Follow her on twitter @beckynagel.


  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • After High-Profile Attacks, Biden Calls for Better Software Security

    Recent high-profile security attacks have prompted the Biden administration to issue an executive order aiming to tighten software security practices across the board.

  • With Hybrid Networks on Rise, Microsoft Touts Zero Trust Security

    Hybrid networks, which combine use of cloud services with on-premises software, require a "zero trust" security approach, Microsoft said this week.

  • Feds Advise Orgs on How To Block Ransomware Amid Colonial Pipeline Attack

    A recent ransomware attack on a U.S. fuel pipeline company has put a spotlight on how "critical infrastructure" organizations can prevent similar attacks.