Microsoft talks up countermeasures to fend off IE attacks

Recommends several moves, with no word on when a patch will be ready

Microsoft warned users of Internet Explorer 7 (IE7) late Wednesday that attackers are actively exploiting a critical bug in the browser, and urged them to take countermeasures in lieu of a patch.

In a late-Wednesday security advisory, Microsoft officially acknowledged the flaw. "We are aware only of limited attacks that attempt to use this vulnerability," the company said, adding that users running IE7 in Windows XP, Windows Vista, Windows Server 2008 and Windows Server 2008 are at risk.

As is its practice, however, the company was vague about whether it would patch the problem, and if so, when. "On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs."

The last time that Microsoft went off its usual once-a-month security update schedule was in late October, when it issued an emergency patch for a bug in Windows that was also being exploited in the wild.

In one way, Microsoft downplayed the threat posed by the IE7 bug, which independent researchers have said is in a browser rendering component , and is triggered by misuse of the HTML "span" tag.

"Our investigation of these attacks so far has verified that they are not successful against customers who have applied the workarounds listed in this advisory," Microsoft said. "Additionally, there are mitigations that increase the difficulty of exploiting this vulnerability."

The company spelled out three things IE7 users can do to protect themselves:

Set "Internet" and "Local internet" security zones to "high." To do that, users must select "Internet Options" from the Tools menu, click the Security tab, click on "Internet," then move the slider to the "High" setting. Repeat for "Local intranet." Click OK.

Disable Active Scripting. Choose "Internet Options" from the Tools menu, click the Security tab, click the "Internet" icon and then the "Custom level" button. In the ensuing dialog, under the "Scripting" section, in the "Active scripting" item, click "Disable," then OK.

Enable DEP (data execution prevention). Select "Internet Options" from the Tools menu, click the Advanced tab, then check "Enable memory protection to help mitigate online attacks." Click OK.

Although multiple exploits have surfaced, all are effective against only IE7. Researchers, including those at Microsoft, are still investigating whether the older IE6 also contains the same vulnerability.

"The information posted in Microsoft's security advisory is what the company knows to be true at this time, [but] Microsoft continues to investigate this vulnerability," a company spokesman replied in an e-mail when asked whether Microsoft had found a similar bug in IE6. "If Microsoft can confirm new information based on its ongoing investigation, it will update the security advisory as necessary."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Internet Explorer

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?