Microsoft Issues Urgent Internet Explorer Security Fix

Microsoft is strongly suggesting Internet Explorer users download a temporary patch to bandage a vulnerability that could allow hackers to take remote control of their computers. Some are tracing it back to the now-infamous Oracle Java attackers.

Redmond on late Monday posted a security advisory urging users to download the Enhanced Mitigation Experience Toolkit if they are using IE version 6 through 9. IE 10, which is set to debut with the new Windows 8 operating system, is not affected.

"Microsoft is aware of targeted attacks that attempt to exploit this vulnerability. A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted or has not been properly allocated," Microsoft said in its advisory.

"The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site."

Installing Poison Ivy

Paul Roberts, a security analyst at Sophos, said the gang behind the recent Java zero-day attacks apparently hasn't packed up for the season. Roberts points to analysis from AlienVault that suggests a zero day is being used in attacks that install the Poison Ivy Trojan.

Meanwhile, French security Web site ZATAZ.com reveals the exploit was discovered when analyzing a batch of files hosted on one of the servers the Nitro gang used to distribute attacks that exploited the Java vulnerability.

After running one of the sample files on a fully patched Windows XP SP3 system with an up-to-date version of Adobe Flash, ZATAZ co-founder Eric Romang "was surprised to find that the files loaded malicious software to his fully patched XP system," Roberts said.

"Further analysis...


Read the rest of this Article Here...

 

Tech News Related Articles:-