IE Harbors Yet Another Bug

Welcome Guest. | Log In| Register | Membership Benefits

September 28, 2006 (4:53 PM EDT)

By Gregg Keizer , TechWeb Technology News

A working exploit against yet another unpatched bug in Internet Explorer has popped up, security researchers, including those at US-CERT, said Thursday.

The flaw is in an ActiveX control included with Windows 2000, Windows XP, and Windows Server, said Symantec. As with another still-unfixed vulnerability disclosed two weeks ago, the control -- WebViewFolderIcon -- can be exploited to overflow Internet Explorer's buffer, then introduce malicious code to the compromised PC. US-CERT, the federal cyber-alert agency, also issued a warning.

HD Moore of Metasploit first reported the vulnerability in July as part of his "Month of Browser Bug" project. Then, however, Moore's proof-of-concept code only demonstrated a denial-of-service that crashed the browser.

"Now that a functional exploit is available, an official patch from Microsoft will likely appear at some point in the future," Symantec said in an alert to customers.

That may be whistling in the dark, however, since Microsoft has several outstanding vulnerabilities to contend with, including the earlier ActiveX flaw and one publicized Wednesday in Microsoft Office's presentation software, PowerPoint.

Microsoft has not posted an advisory for the new flaw, and Symantec and US-CERT only suggested that users either disable Active Scripting in IE or set the "kill bit" for the ActiveX control. The latter, however, is somewhat technical and if done incorrectly, can damage the operating system.

Try TechWeb's RSS Feed!
(Note: The feed delivers stories from TechWeb.com only, not the entire TechWeb Network.)

SECURITY WHITE PAPERS AND REPORTS

Configuration Audit and Control for Virtualized Environments
Find out how to maintain the same level of stability and security across both virtual and physical environments, using the same software and approach.

CIGNA Finds Good Therapy: Builds a More Efficient Risk Management, Streamlined Compliance, and System Security Program
To bolster the vulnerability management portion of its overall risk management program, CIGNA selected QualysGuard, thus enabling the company to streamline control of its entire vulnerability management lifecycle: asset discovery, vulnerability assessments, track security fixes, and meet federal, state, and internal policy regulations.

Best Practices for Windows Vista Planning, Migration, and Ongoing Management
It is vital to ensure PC system and data security during migration to Windows Vista. This white paper highlights considerations that must be addressed over the entire migration process.

System i Management Best Practices an Executive Overview
System i provides a wealth of data to help analyze performance and storage usage, this information can be employed to liberate wasted space and tune the system.