Home
Topics
Application and Platform Security
Web Security Tools and Best Practices
Web Browser Security
Attack code surfaces for Internet Explorer zero-day vulnerability

Article

Attack code surfaces for Internet Explorer zero-day vulnerability

SearchSecurity.com Staff

Security firms are warning about new exploit code that targets a Microsoft Internet Explorer zero-day vulnerability, enabling attackers to take complete control of a vulnerable system.

The vulnerability could be used by attackers in drive-by attacks. The new flaw was reported by French Security firm VUPEN Security Dec. 9 and affects Internet Explorer 6, 7 and 8 running on Windows XP, Windows Vista and Windows 7.

VUPEN gave the vulnerability a "critical" rating. The browser contains a flaw which causes a

Requires Free Membership to View

Login

By submitting you agree to receive email communications from
TechTarget and its partners. Privacy Policy Terms of Use.

memory error in Internet Explorer's HTML parsing engine when it processes Cascading Style Sheet (CSS) import rules in a Web page, according to the VUPEN advisory. Attackers can set up a malicious Web page or inject code into vulnerable websites to target the flaw.

The vulnerability was added Wednesday as an exploit to the Metasploit Framework.

Microsoft blocked five critical vulnerabilities in Internet Explorer in its December round of monthly patches. Some of the flaws patched by Microsoft were being used by attackers in drive-by attacks.

Related Topics: Web Browser Security, Windows Security: Alerts, Updates and Best Practices, VIEW ALL TOPICS

More News and Tutorials

Articles

Related glossary terms

Terms for Whatis.com - the technology online dictionary

Join the conversationComment

Share

Comments

Results

Contribute to the conversation

All fields are required. Comments will appear at the bottom of the article.

More from Related TechTarget Sites

Cloud Security
Consumerization
Financial Security
SMB Security
Security AU
Security IN
Computer Weekly

Cloud Security
- Gartner: Negotiate cloud contracts with detailed security, control
  
  When negotiating with cloud providers, enterprises must demand cloud contracts with specific security and control provisions, Gartner analysts say.
- Cloud data breach notification: Defining legal obligations
  
  Francoise Gilbert provides a cloud data breach notification overview for enterprises concerned about placing personal information in the cloud.
- Are FedRAMP security controls enough?
  
  Cloud service providers are working with authorized third-party auditors to meet FedRAMP security controls. The 3PAOs tell us how it’s going, so far.
Consumerization
- How to choose the right enterprise mobile, cloud and social tools
  
  IT departments need to evaluate vendors for social tools, such as mobile and cloud. Without a secure plan, IT risks an unsecure liability.
- Office Mobile for iPhone requires Office 365
  
  Microsoft released Office Mobile for iPhone but it requires an Office 365 subscription and isn't made for iPad.
- NSA surveillance leads to tighter data privacy policies
  
  Knowledge of the National Security Agency's surveillance has led some companies to revamp their data privacy policies.
searchFinancialSecurity
- PayPal CISO: Laws must foster better cybersecurity information sharing
  
  PayPal's Michael Barrett says many firms fear misuse of shared cybersecurity data. He also discusses the evolution of PCI DSS and mobile payment security.
- Cybergang plans to use Trojan against U.S. banks
  
  A cybergang in Eastern Europe revealed plans to attack U.S. banks with a Gozi-like Trojan, according to RSA.
- Improved Shylock Trojan targets banking users
  
  The latest variant of the banking Trojan is causing numerous problems, Symantec said.
searchMidmarketSecurity
- Windows Phone 7 security: Assessing WP7 security features
  
  Windows Phone 7 security features are proving to be a mixed bag. Sam Cattle assesses the enterprise security pros and cons of the latest Windows mobile platform.
- Choosing the best security certifications for your career
  
  Whether starting your career or planning your next step as an IT security professional, this tip will guide you toward the best certifications for your interests and experience.
- Midmarket security tutorials
  
  SearchMidmarketSecurity.com’s tutorials offer IT professionals in-depth lessons and technical advice on the hottest topics in the midmarket IT security industry. Through our tutorials we seek to provide site members with the foundational knowledge needed to deal with the increasingly challenging job of keeping their organizations secure.
searchSecurityAU
- Exploit kits evolved: How to defend against the latest attack toolkits
  
  Expert Nick Lewis details how automated exploit kits are evolving and offers mitigations for the latest methods employed by these attack toolkits.
- May 2013 Patch Tuesday fixes IE8 zero day; Adobe tightens ColdFusion
  
  The software giant's May 2013 Patch Tuesday update permanently fixes the IE8 zero-day flaw found in the Dept. of Labor website attack.
- Can self-managed cloud security controls ease enterprise concerns?
  
  Expert Dave Shackleford details how enterprises can increasingly manage their own cloud security controls with private virtual cloud offerings.
Information Security
- Security tech market set to grow 8.7% in 2013, says Gartner
  
  The worldwide security technology and services market will reach $67.2bn in 2013, up 8.7% from 2012, according to research firm Gartner
- A malicious charger could hack Apple devices easily, claim researchers
  
  A modified phone charger or battery could be used to hack Apple devices, say researchers from Georgia Tech
- How to reduce IT security risk with IT asset management
  
  IT asset management expert Barb Rembiesa explains how ITAM best practices like IT asset standardization and rationalization reduce IT security risk.
Computer Weekly
- BT CEO Ian Livingston quits to become government minister
  
  BT chief executive Ian Livingston is leaving the telecoms giant in September to become a government minister
- Virtualisation and the LUN: Storage configuration for VMs
  
  Virtualisation and the LUN: Storage admins used to match LUNs to physical servers, but that’s all changed. Find out how in this guide to the basics of VM storage
- G8 publishes Open Data Charter
  
  The G8 nations have committed to open data, with a promise to produce action plans for the release of government information

All Rights Reserved,Copyright 2000 - 2013, TechTarget