Hackers Attack ActiveX Flaw in IE Vulnerability Puts IE 5.01 / 6 Users at Risk Ed Sutherland
Internet Explorer is once again the target of an exploit. The latest, prompting an investigation by Microsoft (Quote, Chart), could allow hackers to take control of some un-patched PCs.
The attack code appears just days after Microsoft's regular monthly patch releases, an increasingly common tactic by malicious hackers.
"This vulnerability may allow an attacker to execute code on a user's machine by convincing them to visit a malicious Web site using Internet Explorer," according to a statement from a Microsoft spokesperson.
The software giant released a security advisory suggesting Windows XP and Windows 2000 disable ActiveX and active scripting features.
Windows 2003 is not affected, according to Microsoft.
Attackers can use a flaw in the multimedia-related ActiveX controls and a specially crafted Web page.
However, Microsoft cautioned it is "not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time."
The exploit is rated as "critical" for IE 5.01 and 6 users, according to the French Security Incident Response Team (FrSIRT).
Microsoft said it "will take the appropriate action," including possibly releasing an out-of-cycle security update.
The new reports come just days after the company's most recent patch release.
Microsoft released the third version of a "critical" combined patch addressing problems injected in previous attempts to correct a number of IE flaws.
Windows users will likely need to wait until October for a patch to resolve this exploit, said Scott Carpenter, director of the Security Labs at Secure Elements, a PC security vendor.
If there is a work-around for a problem, Microsoft won't break from its monthly patch cycle, Carpenter told internetnews.com.
Carpenter, who has tested the new IE exploit, said this makes the third consecutive month where an exploit has followed a Microsoft patch.
"Patch Tuesday" has become part of the IT lexicon, said Andrew Jaquith, a Yankee Group analyst. "Now, we're seeing the emergence of another theme: 'Zero-Day
Wednesday.'
As in this case, exploits are now less likely to depend on an application's vulnerability and instead rely on the security risk between the keyboard and the seat, said Carpenter.
An increasing number of exploits depend upon convincing people to visit a Web page, where malicious files provide hackers access to PCs.
