We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Emergency Internet Explorer patch nears

Microsoft will issue a security update shortly

Microsoft has announced that it will issue an emergency security update for Internet Explorer (IE), and plans to announce a ship date for the fix later today.

"Given the significant level of attention this issue has generated, confusion about what customers can do to protect themselves and the escalating threat environment, Microsoft will release a security update out-of-band for this vulnerability," said George Stathakopoulos, general manager of the Trustworthy Computing Security group, in an entry on the Microsoft Security Response Center (MSRC) blog.

"We take the decision to go out-of-band very seriously, given the impact to customers, but we believe releasing an update out-of-band update is the right decision at this time," Stathakopoulos said.

"It was inevitable, given all the hubbub," said Andrew Storms, director of security operations at nCircle Network Security. Last week, Storms predicted Microsoft would rush out an update before the next regularly-scheduled Patch Tuesday of February 9.

The IE flaw has gained more attention than most zero-day bugs because it has been linked to the attacks that broke into Google's corporate network last month. Google has claimed that the attacks originated in China.

Researchers have been busy building exploits since the original attack code went public last Thursday. Yesterday, for example, a noted American vulnerability researcher and a French security company disclosed that they had created exploits that worked on the newer IE7 and IE8, and could bypass the DEP (data execution prevention) protection that Microsoft has been touting since it acknowledged the bug.

As he did over the weekend, Stathakopoulos downplayed the threat again yesterday.

"We continue to see very limited, and in some cases, targeted attacks," he said, adding that the only successful attacks found thus far have aimed at IE6. Stathakopoulos's phrasing, however, was different yesterday than on Sunday, when he last blogged, leaving it open to interpretation whether Microsoft has covertly confirmed reports from others that hackers are already leveraging the IE vulnerability in web-based drive-by attacks.

Microsoft rarely issues out-of-band security updates. The last time it did so was July 2009, when it patched IE just hours before several researchers demonstrated a critical vulnerability at a security conference. Prior to the 2009 fix, Microsoft's most recent emergency update was a Windows patch in October 2008. That vulnerability was later exploited by the notorious Conficker worm.

See also:

Computerworld US


IDG UK Sites

Very best Black Friday 2014 tech deals UK: Latest bargains on phones, tablets, laptops and more...

IDG UK Sites

Black Friday feeding frenzy infects the UK

IDG UK Sites

VAT MOSS: Will I be affected by the EU VAT changes? Here are the facts for designers and artists

IDG UK Sites

Black Friday 2014 UK: Apple deals, Amazon deals & Black Friday tech offers