Microsoft patches critical IE bug with emergency update
Researchers give the company high marks for getting a fix out fast
Computerworld - As it promised yesterday, Microsoft Corp. today issued an emergency patch to plug a critical hole in Internet Explorer (IE) that attackers have been increasingly exploiting from hacked Web sites.
The patch, described in Microsoft's security bulletin MS08-078, fixes a flaw in the data-binding function of all available versions of the popular browser, including IE5.01, IE6, IE7 and IE8 Beta 2.
Microsoft labeled the bug as "critical," the most serious threat ranking in its four-step scoring system. Today's update was the second out-of-cycle patch from Microsoft in the past two months.
Researchers unanimously praised Microsoft for putting out the patch as quickly as it did.
"This was clearly an all-hands-on deck effort," said Eric Schultze, chief technology officer at Shavlik Technologies LLC. "The out-of-band process worked exactly as intended in this case."
Andrew Storms, the director of security operations at nCircle Network Security Inc., seconded Schultze. "This was a classic case of what we would like to happen. Microsoft acknowledged the fault, issued work-arounds, gave us advance notice that it would patch and then released the patch," he said.
Wolfgang Kandek, chief technology officer at Qualys Inc., also applauded Microsoft. "Considering the way that Microsoft is set up, I thought this was pretty quick," he said.
Microsoft first acknowledged the vulnerability a week ago today, one day after it unleashed its biggest set of security updates in more than five years. At the time, it said that only the newest production version of the browser, IE7, was at risk, but the company quickly changed its tune when additional research revealed that all versions contained the bug.
According to both Microsoft and numerous security firms, attacks have been mounting, particularly since last weekend, when hackers began hijacking legitimate Web sites and launching exploits against unwary visitors. In fact, Microsoft said it monitored a "huge increase" in attacks last Saturday.
Reports of the vulnerability and publicly-available exploit code first surfaced Dec. 9, although at least one researcher said he had found evidence of attacks starting three days before.
In any case, Microsoft was quick to respond, said researchers. "They're getting better in terms of their speed and agility to respond," said Storms. "Actually, today was very anticlimactic. Probably the biggest part of this was all the build-up."
The analysts agreed that Microsoft didn't act in a vacuum, but pushed the patch process because of the attack situation. "By late last week, Microsoft was aware that this issue was starting to infect users' systems at a faster rate than they've seen with past zero-day exploits," said Schultze in a follow-up e-mail today.
"They fixed this so quickly because [the exploit] became public," added Storms.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!