News

Microsoft Warns of IE 6 and IE 7 Bug

A new zero-day Internet Explorer bug awaits IT pros returning from the holiday break.

Just before Thanksgiving Day, Microsoft released a security advisory on a vulnerability affecting IE 6 and IE 7 browsers, based on "new public reports." Browser versions that aren't affected include IE 8 and IE 5.01 Service Pack 4, according to Microsoft.

Microsoft is continuing to investigate the bug, which allows an attack based on the deletion of a cascading style sheet (CSS) object. The security bulletin indicated that IE 6 SP1 on Windows 2000 SP4 may be affected. Other affected browsers may include IE 6 and IE 7 on Windows XP, Windows Vista, Windows Server 2003 and Windows Server 2008.

Microsoft's security advisory explained that hackers can potentially run malicious code after a CSS object gets deleted.

"It is possible under certain conditions for a CSS/Style object to be accessed after the object is deleted," the bulletin stated. "In a specially-crafted attack, Internet Explorer attempting to access a freed object can lead to running attacker-supplied code."

The bulletin adds that users still have to be diverted to a malicious Web page in order for the attack to occur.

IT pros need to have preventive measures in place, both for this bug and in general, according to Paul Henry, security and forensic analyst at Lumension.

"The latest Internet Explorer zero-day threat will unfortunately catch many off guard and will have a significant impact on many organizations that are still relying on outdated defenses," Henry said. "Vendor software vulnerabilities are not going away and zero-day threats will continue to plague even those organizations that have the best of the best in flaw remediation plans in place."

The security advisory offered a few workarounds for the issue until the vulnerability is patched. The workarounds involve changing IE's security zone settings, configuring active scripting settings in IE and turning on data execution prevention in the browser.

Microsoft explained that protected mode, available in IE 7 running on Windows Vista, "limits the impact of the vulnerability." Also, there is some protection for those running IE on Windows Server 2003 and Windows Server 2008. By default, those operating systems use Microsoft's enhanced security configuration, which sets IE's Internet zone security level to "high."

To date, there's no word on when a patch will arrive, which could appear with Microsoft's monthly patch release or in an out-of-band fix.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Linux Apps Support Comes to Cameyo Virtual App Delivery Service

    Cameyo on Wednesday announced that its Virtual App Delivery service now supports Linux applications, expanding from Windows apps support.Cameyo's Virtual App Delivery service has extended its support to Linux applications, the company announced on Wednesday.

  • Rackspace-Hosted Exchange Service Gets Hit with Ransomware Attack

    Managed services provider Rackspace issued an announcement on Tuesday confirming that its hosted Microsoft Exchange e-mail service was disrupted by a ransomware attack. Rackspace's hosted Microsoft Exchange e-mail service was disrupted by a ransomware attacks, the managed services provider confirmed on Tuesday.

  • Microsoft Turns to Partners for Azure Kubernetes Service Boost

    In a joint statement by Microsoft and Isovalent on Monday, the two companies announced that Microsoft's Azure Kubernetes Service (AKS) will be receiving eBPF capabilities.

  • Microsoft Adds Privileged Identity Management Delegation to Azure Lighthouse

    The commercial release of Privileged Identity Management (PIM)-enabled Azure Lighthouse delegations is now available, Microsoft on Monday announced.