Microsoft confirms critical IE bug, works on fix

Computerworld - Microsoft late Wednesday confirmed that all versions of Internet Explorer (IE) contain a critical vulnerability that attackers can exploit by persuading users to visit a rigged Web site.

Although the company said it would patch the problem, it is not planning to rush out an emergency update.

"The issue does not currently meet the criteria for an out-of-band release," said Carlene Chmaj, a spokeswoman for the Microsoft Security Response Center (MSRC), in an entry on the center's blog. "However, we are monitoring the threat landscape very closely and if the situation changes, we will post updates."

Chmaj also downplayed the threat posed by the bug. "Currently the impact of this vulnerability is limited and we are not aware of any affected customers or active attacks targeting customers," she said.

The vulnerability in IE6, IE7 and IE8 surfaced several weeks ago when French security firm Vupen disclosed a flaw in IE's HTML engine. Tuesday, researchers posted a video demonstration of an attack, and added a reliable exploit to the Metasploit penetration toolkit.

That exploit used a technique revealed earlier this year by McAfee researchers that defeats a pair of important Windows defensive technologies -- ASLR (address space layout randomization) and DEP (data execution prevention) -- designed to stymie most attacks.

The appearance of the Metasploit attack code may have been what prompted Microsoft to take action, as the company's more technical "Security Research & Defense" blog highlighted the Metasploit module.

In that blog, Microsoft security software engineer J. Serna also confirmed that IE's "mscorie.dll" file does not always automatically enable ASLR, a technology that randomly allocates executable memory to make it difficult for hackers to run their code.

Until a patch is ready, Microsoft urged users to use the Enhanced Mitigation Experience Toolkit (EMET) utility to bolster IE's defenses. The company provided instructions on how to configure EMET to block attacks in the accompanyingsecurity advisory.

EMET is a tool designed for advanced users, primarily enterprise IT pros, and manually enables ASLR and DEP for specific applications. It's often used to reinforce older programs.

Microsoft has recommended EMET before as a stop-gap defense. In September, it told users to configure it to block attacks then targeting users of Adobe Reader. But this is just the second time that Microsoft has suggested users roll out EMET to protect an up-to-date Microsoft program.

EMET 2.0 is a free download available from Microsoft's site.

Users running IE7 or IE8 on Windows Vista and Windows 7 are less likely to be affected by a successful attack, Microsoft claimed, because those browsers include a feature called "Protected Mode" that prompts users before letting them install, run or modify certain operating system components.

Other browsers, including Firefox, Chrome, Safari and Opera, are not affected by the flaw.

The next regularly scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.

The last time the company issued an out-of-band update was late September when it patched a bug in the ASP.Net Web application framework.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.

Read more about Browsers in Computerworld's Browsers Topic Center.