Exploit code targets Internet Explorer zero-day display flaw

By Robert Westervelt, News Editor
23 Nov 2009 | SearchSecurity.com

Symantec Corp. is warning of a new publicly available exploit code targeting an unpatched display vulnerability in Internet Explorer (IE) that could enable hackers to conduct drive-by attacks and spread malware on unsuspecting victim machines.

The IE zero-day vulnerability affects the way the browser handles cascading style sheet (CSS) information used to lay out webpages. The vulnerability affects Internet Explorer versions 6 and 7. Symantec said the IE zero-day attack could infect users by using malicious JavaScript code.

"The exploit currently exhibits signs of poor reliability, but we expect that a fully functional a reliable exploit will be available in the near future," Symantec said in a blog posting on Saturday. "For an attacker to launch a successful attack, they must lure victims to their malicious webpage or a website they have compromised."

Cupertino, Calif.-based Symantec said the IE zero-day exploit code appeared Friday on the Bugtraq mailing list. Symantec and several other security vendors are providing antivirus and IPS signatures to protect against the attack.

"Internet Explorer users should ensure their antivirus definitions are up to date, disable JavaScript and only visit websites they trust until fixes are available from Microsoft," Symantec said.

IT security research and alert vendor VUPEN Security also reported the vulnerability on Saturday, saying the flaw is a dangling pointer in the Microsoft HTML Viewer (mshtml.dll).

Danish vulnerability clearinghouse Secunia gave the IE zero-day flaw a highly critical rating in an alert issued today. Secunia confirmed the vulnerability in IE6 on Windows XP SP2 and IE7 on Windows XP SP3A.

Microsoft has not yet acknowledged the vulnerabilities. The software giant patched a serious Windows kernel flaw earlier this month, fixing a vulnerability that enabled attackers to set up a malicious website and target users of Internet Explorer using embedded OpenType font.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1375179,00.html

Nuevamente una vulnerabilidad en un producto de Microsoft puede conducir a a taques y al esparcimiento de código malicioso en equipos comprometidos, al parecer el exploit de día cero para las versiones 6 y 7 de Internet Explorer hasta el momento no ha representado un problema serio, pero empresas como Symantec esperan que un exploit completamente funcional sea liberado en poco tiempo y para variar, Microsoft no ha reconocido dicha vulnerabilidad. Y qué podemos hacer? mantener actualizados nuestro antivirus, desactivar las funciones de javascript, actualizar a IE8 o mudarse a algún otro explorador y/o plataforma.