View Single Post
Old 12-23-10, 11:30 AM   #1
Drolfrawd
Registered User
 
Drolfrawd's Avatar
 
Join Date: Jan 2008
Posts: 2,787
Send a message via MSN to Drolfrawd
Default Microsoft warns on IE browser bug

Microsoft warns on IE browser bug

Quote:
Microsoft has issued a warning about a serious vulnerability in all versions of its Internet Explorer (IE) browser.

If exploited by a booby-trapped webpage the bug would allow attackers to take control of an unprotected computer.

Code to exploit the bug has already been published though Microsoft said it had no evidence it was currently being used by hi-tech criminals.

A workaround for the bug has been produced while Microsoft works on a permanent fix.
Code injection

The bug revolves around the way that IE manages a computer's memory when processing Cascading Style Sheets - a widely used technology that defines the look and feel of pages on a website.

Hi-tech criminals have long known that they can exploit IE's memory management to inject their own malicious code into the stream of instructions a computer processes as a browser is being used. In this way the criminals can get their own code running and hijack a PC.

Microsoft has produced updates that improves memory management but security researchers discovered that these protection systems are not used when some older parts of Windows are called upon.

In a statement Microsoft said it was "investigating" the bug and working on a permanent fix. In the meantime it recommended those concerned use a protection system known as the Enhanced Mitigation Experience Toolkit.

Installing and applying the toolkit may require Windows XP users to update the version of the operating system they are using. But even if they do that some of the protection it bestows on Windows 7 and Vista users will not be available.

"We're currently unaware of any attacks trying to use the claimed vulnerability or of customer impact," said Dave Forstrom, the director of Microsoft's Trustworthy Computing group, in a statement.

"As vulnerabilities go, this kind is the most serious as it allows remote execution of code," said Rik Ferguson, senior security analyst at Trend Micro, "This means the attacker can run programs, such as malware, directly on the victim's computer."

He added: "It is highly reminiscent of a vulnerability at the same time two years ago which prompted several national governments to warn against using IE and to switch to an alternative browser."
Glad i have binned this ages ago

Edit: Justa thought for all of you who like me need ie for work, well you van use "IE tab " in firefox and you will be able to display your web pages normally.
Drolfrawd is offline   Reply With Quote