Microsoft To Patch Newest IE Flaw

Welcome Guest. | Log In| Register | Membership Benefits

September 29, 2006 (12:23 PM EDT)

By Gregg Keizer , TechWeb Technology News

Microsoft has confirmed a new, unpatched vulnerability in Internet Explorer, and promised to fix the problem with an update on Oct. 10.

In a security advisory posted on its support site, Microsoft admitted that an ActiveX control -- WebViewFolderIcon, also called "Web View" -- exposes a vulnerability in the Windows Shell that can be exploited by attackers to hijack PCs. The likely attack vector, said Microsoft, would be the now-standard malicious Web site; victims would have to be drawn to the site with e-mailed or IMed lures, or surf to it on their own to be attacked. All currently-support editions of Windows are at risk, including Windows 2000, XP (SP1 and SP2), and Windows Server.

Thursday, security vendors and organizations, including Symantec and US-CERT, warned that exploit code had been released. The bug was originally reported in July as part of HD Moore's "Month of Browser Bugs" project where he identified dozens of flaws in IE and other Web browsers. The vast majority of those vulnerabilities remain unpatched.

Microsoft also detailed several workarounds that users could implement until a patch is available, including disabling all ActiveX controls and setting the "kill bit" to turn off only the WebViewFolderIcon control. The latter, however, requires editing the Windows Registry, which can be hazardous if done incorrectly.

The advisory can be found here.

Try TechWeb's RSS Feed!
(Note: The feed delivers stories from TechWeb.com only, not the entire TechWeb Network.)

SECURITY WHITE PAPERS AND REPORTS

Configuration Audit and Control for Virtualized Environments
Find out how to maintain the same level of stability and security across both virtual and physical environments, using the same software and approach.

CIGNA Finds Good Therapy: Builds a More Efficient Risk Management, Streamlined Compliance, and System Security Program
To bolster the vulnerability management portion of its overall risk management program, CIGNA selected QualysGuard, thus enabling the company to streamline control of its entire vulnerability management lifecycle: asset discovery, vulnerability assessments, track security fixes, and meet federal, state, and internal policy regulations.

Best Practices for Windows Vista Planning, Migration, and Ongoing Management
It is vital to ensure PC system and data security during migration to Windows Vista. This white paper highlights considerations that must be addressed over the entire migration process.

Auditing: What You Need to Know
All companies must go through a formal auditing process to ensure they're meeting various compliance demands. In theory, this exercise will help them understand where their security holes are and how to make appropriate improvements. But how do companies ensure their auditors understand specific IT security issues and requirements? We find out.