IE zero-day danger growing

Large numbers of users vulnerable to unpatched problem.

The as-yet unpatched vulnerability in

Microsoft

‘s

Internet Explorer

browser,

reported

last week and coinciding with the release of the monthly ‘Patch Tuesday’ security updates, is becoming more serious by the day as more and more infected websites appear to be attempting to exploit the flaw to gain access to visitors’ systems.

The vulnerability was thought only to affect

IE7

when first discovered, and was being exploited only by limited numbers of targeted trojans. Since then, attacks via the vulnerability have been shown to work on a wide range of

Windows

and

IE

variants, and have been widely seeded to both malicious websites and legitimate sites that have been compromised to display malicious content.

A

blog post

issued by

Microsoft

on Saturday claimed a 50% rise in attacks spotted in the previous 24 hours, with as many as 0.2% of all web users exposed to the threat. The same day,

Trend Micro

researchers

reckoned

that some 6,000 web pages were playing host to exploits targeting the vulnerability. Numbers are thought to have climbed rapidly since then.

Technical details of the vulnerability, including affected systems and possible workarounds, are in the updated advisory from

Microsoft

,

here

, or in vulnerability reporting systems at


Secunia


,


US-CERT


and


Sophos


. More coverage is in blog posts from


F-Secure


,

Sophos


here

and

here

, from

SANS


here

, and in the

Washington Post


here

.

Posted on 16 December 2008 by

Virus Bulletin