We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Researchers confirm Internet Explorer bug

Microsoft browser 'vulnerable to drive-by attacks'

Security researchers today confirmed the presence of a bug in Internet Explorer (IE) that's at the centre of a spat between Microsoft and a Google security engineer.

According to Vupen, IE8 harbours a vulnerability that can be exploited to hijack a Windows system.

"A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to take complete control of a vulnerable system," said the French firm in an advisory.

Vupen said it confirmed the vulnerability and its exploitability in IE8 running on Windows XP Service Pack 3 (SP3), but believed it could also be leveraged on Windows Vista, Windows 7, Server 2003, Server 2008 and Server 2008 R2.

The security company rated the bug as 'critical', its highest threat warning. In a follow-up tweet , Vupen said: "Reproducing was/is hard."

The bug was publicly reported last week by Michal Zalewski, a Google security engineer, when he released a new 'fuzzing' tool that had found more than 100 bugs in the five major browsers: IE, Firefox, Chrome, Safari and Opera. He also published a crash dump of one of the IE bugs he believed could be exploited.

Zalewski's release of 'cross_fuzz' and the crash dump has sparked a skirmish between him and Microsoft.

The latter has claimed that even though its engineers have had the fuzzer since July, they were only able to identify the vulnerability on December 21, 2010, when Zalewski provided a newer version of the tool.

Zalewski has disputed that in a detailed timeline of the back-and-forth with Microsoft. Earlier this week he said he released cross_fuzz and the crash dump because Chinese hackers were already probing for information on the bug, and because Microsoft had not responded for months to his bug report.

Vupen identified the IE vulnerability as a 'use-after-free error' within 'mshtml.dll', the code library that composes the browser engine. Attackers could exploit the bug by enticing people to a malicious web page - a classic 'drive-by' attack that compromises the browser as soon as it renders the page.

Microsoft has said it is investigating the IE vulnerability, but has not issued a security advisory or revealed its patching plans.

With the Vupen confirmation, Microsoft now has four unpatched bugs to work on, including a critical IE bug it acknowledged two weeks ago, a WMI Active X flaw in IE that went public at the same time, and a Windows vulnerability the company confirmed.

See also: The 5 best browser innovations of 2010


IDG UK Sites

Windows 9 launch event live: Windows 9 launch live blog - find out first as the new Windows is...

IDG UK Sites

Windows 9 and the death of the OS as a must-have product

IDG UK Sites

Video trends: 4K is here โ€“ HDR video, VR and 3D audio is coming

IDG UK Sites

Best iPhone 6, iPhone 6 Plus deals: iPhone 6, iPhone 6 Plus tariffs, contracts and prices UK