News Stay informed about the latest enterprise technology news and product updates.

Microsoft warns that IE zero-day vulnerability causes data leakage

A new Microsoft advisory warns of a zero-day vulnerability that could result in information disclosure for users of Windows XP.

Microsoft issued a new advisory late Wednesday, warning Internet Explorer (IE) users of the potential for data leakage as a result of new publicly disclosed IE zero-day vulnerabilities.

The IE vulnerabilities could result in information disclosure for users running any version of the browser on Windows XP or users who have disabled Internet Explorer Protected Mode. The software giant said it is unaware of any IE zero-day attacks targeting the vulnerabilities.

Microsoft updates:
Jan. - Microsoft issues critical security update, blocks IE 6 attacks: Microsoft issued an emergency patch today blocking ongoing attacks against corporate networks that have been exploiting a vulnerability in Internet Explorer 6.

Jan. - Microsoft releases Windows OpenType Font Engine patch: Lone security bulletin is critical for Windows 2000 users.

Dec. - Microsoft gives Internet Explorer a major security overhaul: The final regular Microsoft update of 2009 repairs five critical vulnerabilities in IE and blocks public exploit code, which surfaced in November. 

An attacker could target the hole by setting up a drive-by attack on a webpage. Microsoft said malicious code could also be served up in certain Web advertisements.

Until a patch is issued, a temporary Microsoft Fix-it (direct download) has been made available for Windows XP users. It automates Network Protocol Lockdown and can be deployed by enterprises through their automated systems, Microsoft said. In addition, Microsoft also provided a guide for system administrators describing manual steps for deploying the temporary network protocol fix.

Microsoft said users running IE 7 or 8 on Windows Vista and Windows 7 are not vulnerable to the flaw because the default configuration puts users in IE Protected Mode.

Danish vulnerability clearinghouse Secunia gave the IE zero-day vulnerability a "moderately critical" rating. Secunia said an error results when the browser incorrectly handles redirections bypassing domain restrictions. It results in disclosure of some local files. A second flaw results when the browser handles a "dynamically created object," also disclosing certain files.

"Successful exploitation of the vulnerabilities requires that the full path to a target file is known prior to the attack," Secunia said in its advisory.

Patch issued for corporate attacks targeting IE 6 users.
Microsoft issued an emergency, out-of-band update last month addressing eight vulnerabilities in Internet Explorer. The update was the result of high-profile, ongoing attacks targeting corporate users of IE 6 on Windows XP.

The attacks were carried out against Google, Adobe Systems Inc. and more than 30 other companies. Microsoft said all the vulnerabilities can lead to either information disclosure or enable an attacker to take complete control of a system.

Dig Deeper on Microsoft Windows security

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.