Microsoft talks up countermeasures to fend off new IE attacks
Recommends several moves, with no word on when a patch will be ready
Computerworld - Microsoft Corp. warned users of Internet Explorer 7 (IE7) late yesterday that attackers are actively exploiting a critical bug in the browser, and urged them to take countermeasures in lieu of a patch.
In a late Wednesday security advisory, Microsoft officially acknowledged the flaw. "We are aware only of limited attacks that attempt to use this vulnerability," the company said, adding that users running IE7 in Windows XP, Windows Vista, Windows Server 2008 and Windows Server 2008 are at risk.
As is its practice, however, the company was vague about whether it would patch the problem, and if so, when. "On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process or an out-of-cycle security update, depending on customer needs."
The last time that Microsoft went off its usual once-a-month security update schedule was in late October, when it issued an emergency patch for a bug in Windows that was also being exploited in the wild.
In one way, Microsoft downplayed the threat posed by the IE7 bug, which independent researchers have said is in a browser rendering component and is triggered by misuse of the HTML "span" tag.
"Our investigation of these attacks so far has verified that they are not successful against customers who have applied the work-arounds listed in this advisory," Microsoft said. "Additionally, there are mitigations that increase the difficulty of exploiting this vulnerability."
The company spelled out three things IE7 users can do to protect themselves:
Set "Internet" and "Local intranet" security zones to "high." To do that, users must select "Internet Options" from the Tools menu, click the Security tab, click on "Internet," then move the slider to the "High" setting. Repeat for "Local intranet." Click OK.
Disable Active Scripting. Choose "Internet Options" from the Tools menu, click the Security tab, click the "Internet" icon and then the "Custom level" button. In the ensuing dialog, under the "Scripting" section, in the "Active scripting" item, click "Disable," then OK.
Enable DEP (data execution prevention). Select "Internet Options" from the Tools menu, click the Advanced tab, then check "Enable memory protection to help mitigate online attacks." Click OK.
Although multiple exploits have surfaced, all are effective against only IE7. Researchers, including those at Microsoft, are still investigating whether the older IE6 also contains the same vulnerability.
"The information posted in Microsoft's security advisory is what the company knows to be true at this time, [but] Microsoft continues to investigate this vulnerability," a company spokesman replied in an e-mail when asked whether Microsoft had found a similar bug in IE6. "If Microsoft can confirm new information based on its ongoing investigation, it will update the security advisory as necessary."
Mary Landesman, a senior security researcher at ScanSafe Inc., a San Francisco-based security company, noted that if IE6 does turn out to be vulnerable to attack, users can protect themselves by switching on DEP in the operating system.
Because IE6 lacks a DEP setting, users running Windows XP, both Service Pack 2 (SP2) and SP3, must turn it on in the operating system instead. To do so, right-click "My Computer," select "Properties" from the ensuing menu, then click the "Advanced" tab. Under the "Performance" section, click the "Settings" button, then the "Data Execution Prevention" tab. Select the "Turn on DEP for all programs and services except those I select:" and click OK.
IE8, which is in Beta 2 at the moment, enables DEP by default.
Also today, researchers at iDefense, a security intelligence firm owned by VeriSign Inc., said that the first exploit made public -- which targets Windows XP and Server 2003 systems -- was mistakenly released by Chinese security analysts.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts