Microsoft issues 'fix it' for IE vulnerability

The company occasionally issues a fix while a permanent patch is developed

Microsoft has released a quick fix for a vulnerability in older versions of its Internet Explorer browser that is actively being used by attackers to take over computers.

The vulnerability affects IE versions 6, 7 and 8. The latest versions of the browser, 9 and 10, are not affected. The company occasionally issues quick fixes as a temporary protective measure while a permanent security update is developed if a vulnerability is considered particularly dangerous.

Microsoft issued an advisory on Saturday warning of the problem, which involves how IE accesses "an object in memory that has been deleted or has not been properly allocated." The problem corrupts the browser's memory, allowing attackers to execute their own code.

The vulnerability can be exploited by manipulating a website in order to attack vulnerable browsers, one of the most dangerous types of attacks known as a drive-by download. Victims merely need to visit the tampered site in order for their computer to become infected. To be successful, the hacker would have to lure the person to the harmful website, which is usually done by sending a malicious link via email.

Security vendor Symantec described such a scenario as a "watering hole" attack, where victims are profiled and then lured to the malicious site. Last week, one of the websites discovered to have been rigged to delivered an attack was that of the Council on Foreign Relations, a reknowned foreign policy think tank.

The attack delivers a piece of malware nicknamed Bifrose, a malware family first detected around 2004. Bifrose is a "backdoor" that allows an attacker to steal files from a computer. Symantec wrote that the attacks using the IE vulnerability appear to be limited and concentrated in North America, indicating a targeted attack campaign.

Since the attacks already under way before the vulnerability was discovered, Symantec said it "suggests a high level of sophistication requiring access to resources and skills which would normally be outside most hackers capabilities."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags patchessecurityMicrosoftExploits / vulnerabilitiesmalware

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?