Researchers confirm Googler's Internet Explorer bug
French firm Vupen says Microsoft's browser vulnerable to drive-by attacks
Computerworld - French security researchers today confirmed the presence of a bug in Internet Explorer (IE) that's at the center of a spat between Microsoft and a Google security engineer.
According to Vupen, IE8 harbors a vulnerability that can be exploited to hijack a Windows system.
"A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to take complete control of a vulnerable system," said the French firm in an advisory published Wednesday.
Vupen said it confirmed the vulnerability and its exploitability in IE8 running on Windows XP Service Pack 3 (SP3), but believed it could also be leveraged on Windows Vista, Windows 7, Server 2003, Server 2008 and Server 2008 R2.
The security company rated the bug as "critical," its highest threat warning. In a follow-up tweet, Vupen said, "Reproducing was/is hard."
The bug was publicly reported last Saturday by Michal Zalewski, a Google security engineer, when he released a new "fuzzing" tool that had found more than 100 bugs in the five major browsers: Chrome, Firefox, Internet Explorer (IE), Opera and Safari. He also published a crash dump of one of the IE bugs he believed could be exploited.
Zalewski's release of "cross_fuzz" and the crash dump has sparked a skirmish between him and Microsoft.
The latter has claimed that even though its engineers have had the fuzzer since July, they were only able to identify the vulnerability Dec. 21, 2010, when Zalewski provided a newer version of the tool.
Zalewski has disputed that in a detailed timeline of the back-and-forth with Microsoft. Earlier this week he said he released cross_fuzz and the crash dump because Chinese hackers were already probing for information on the bug, and because Microsoft had not responded for months to his bug report.
Vupen identified the IE vulnerability as a "use-after-free error" within "mshtml.dll," the code library that composes the browser engine. Attackers could exploit the bug by enticing people to a malicious Web page -- a classic "drive-by" attack that compromises the browser as soon as it renders the page.
Microsoft has said it is investigating the IE vulnerability, but has not issued a security advisory or revealed its patching plans.
With the Vupen confirmation, Microsoft now has four unpatched bugs to work on, including a critical IE bug it acknowledged two weeks ago, a WMI Active X flaw in IE that went public at the same time, and a Windows vulnerability the company confirmed Tuesday.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!