Microsoft patches critical IE bug with emergency update
Researchers give the company high marks for getting a fix out fast
Computerworld - As it promised yesterday, Microsoft Corp. today issued an emergency patch to plug a critical hole in Internet Explorer (IE) that attackers have been increasingly exploiting from hacked Web sites.
The patch, described in Microsoft's security bulletin MS08-078, fixes a flaw in the data-binding function of all available versions of the popular browser, including IE5.01, IE6, IE7 and IE8 Beta 2.
Microsoft labeled the bug as "critical," the most serious threat ranking in its four-step scoring system. Today's update was the second out-of-cycle patch from Microsoft in the past two months.
Researchers unanimously praised Microsoft for putting out the patch as quickly as it did.
"This was clearly an all-hands-on deck effort," said Eric Schultze, chief technology officer at Shavlik Technologies LLC. "The out-of-band process worked exactly as intended in this case."
Andrew Storms, the director of security operations at nCircle Network Security Inc., seconded Schultze. "This was a classic case of what we would like to happen. Microsoft acknowledged the fault, issued work-arounds, gave us advance notice that it would patch and then released the patch," he said.
Wolfgang Kandek, chief technology officer at Qualys Inc., also applauded Microsoft. "Considering the way that Microsoft is set up, I thought this was pretty quick," he said.
Microsoft first acknowledged the vulnerability a week ago today, one day after it unleashed its biggest set of security updates in more than five years. At the time, it said that only the newest production version of the browser, IE7, was at risk, but the company quickly changed its tune when additional research revealed that all versions contained the bug.
According to both Microsoft and numerous security firms, attacks have been mounting, particularly since last weekend, when hackers began hijacking legitimate Web sites and launching exploits against unwary visitors. In fact, Microsoft said it monitored a "huge increase" in attacks last Saturday.
Reports of the vulnerability and publicly-available exploit code first surfaced Dec. 9, although at least one researcher said he had found evidence of attacks starting three days before.
In any case, Microsoft was quick to respond, said researchers. "They're getting better in terms of their speed and agility to respond," said Storms. "Actually, today was very anticlimactic. Probably the biggest part of this was all the build-up."
The analysts agreed that Microsoft didn't act in a vacuum, but pushed the patch process because of the attack situation. "By late last week, Microsoft was aware that this issue was starting to infect users' systems at a faster rate than they've seen with past zero-day exploits," said Schultze in a follow-up e-mail today.
"They fixed this so quickly because [the exploit] became public," added Storms.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts