Microsoft Warns of Zero Day Bug Affecting Internet Explorer 6-8 - HotHardware
Microsoft Warns of Zero Day Bug Affecting Internet Explorer 6-8

Microsoft Warns of Zero Day Bug Affecting Internet Explorer 6-8

Microsoft is currently investigating reports of a zero day bug affecting Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8, the company announced in a Security Advisory. At issue is a remote code execution vulnerability that would allow attackers to seize control of a Windows PC.

How it works is IE attempts to reference and use an object that had previously been freed. The components of an exploit for such a vulnerability are typically:
  • Javascript to trigger the Internet Explorer vulnerability
  • Heap spray or similar memory preparation to ensure the memory being accessed after it has been freed is useful
  • A way around the ASLR platform-level mitigation
  • A way around the DEP platform-level mitigation


Microsoft suggests disabling certain services while it works on a patch. Alternately, you can use an different browser like Google Chrome

"The IE team is working around the clock to develop a security update to address this vulnerability for earlier versions of the product," Microsoft stated. " However, until the update is available, customers using Internet Explorer 8 can block the current targeted attacks by introducing changes to disrupt any of the elements of the exploit."

Those changes include disabling Javascript, disabling Flash, and disabling the MS-Help protocol handler along with ensuring "Java6" is not allowed to run.

The vulnerability is not present in IE9 or IE10.
0
+ -

Who the heck still uses any browser (from any browser maker) that is so old?

Just leave it unpatched. At least that way some of the users might update their browsers to versions a bit more recent.

+1
+ -

>> Who the heck still uses any browser (from any browser maker) that is so old?

Corporations. My company bought so deep into the IE6 crap that we still have IE6 and IE8 as our only browsers on the desktop. This is why I stress to everyone: DON'T USE PROPRIETARY THINGS.

0
+ -

Yeah, we had that problem until a couple of years ago; at least my company upgraded to W7 a while ago, but now there's this ridiculous mess of our intranet data management GUI some employees need uses a more recent version of Flash while the IT refuses to upgrade and it's causing all sorts of problem

Login or Register to Comment
Post a Comment
Username:   Password: