Microsoft Confirms Patch For Internet Explorer Zero-Day

Microsoft moves after various websites serve up exploits for an unpatched flaw in the browser

On by Thomas Brewster 0

Microsoft has confirmed it will issue an out-of-band patch to cover a zero-day flaw in Internet Explorer, excluding versions 9 and 10.

The memory corruption flaw was flagged at the start of the year, leading Microsoft to offer a workaround for users whilst it worked on a proper patch.

Internet-Explorer Microsoft IEYet researchers at vulnerability expert Exodus Intelligence found a way to easily get around the Fix It solution and thereby exploit the flaw.

Microsoft will be releasing a patch later today, which should see the problem eradicated entirely.

Internet Explorer getting  in a fix

“While we have still seen only a limited number of customers affected by the issue, the potential exists that more customers could be affected in the future.  The bulletin has a severity rating of Critical,” Microsoft noted in a blog post.

“We recommend that you install this update as soon as it is available. This update for Internet Explorer 6-8 will be made available through Windows Update and our other standard distribution channels.

“If you have automatic updates enabled on your PC, you won’t need to take any action.  If you applied the Fix it released in Security Advisory 2794220, you won’t need to uninstall it before applying the security update.”

Researchers have found a number of websites serving up exploits targeting the flaw, including US-based think-tank Council on Foreign Relations and Capstone Turbine, a US micro-turbine manufacturer.

Symantec suggested the Elderwood Group of hackers were exploiting the vulnerability. The collective was suspected to have been involved in the hit on Google in the famous Aurora attacks of 2009/10.

What do you know about online security? Try our quiz and find out!

Thomas Brewster
Author: Thomas Brewster
Security Correspondent, TechWeekEurope
Thomas Brewster Thomas Brewster Thomas Brewster
Techweekeurope for mobile devices
Android-App Google Currents App for iOS

Last comment

0 replies to Microsoft Confirms Patch For Internet Explorer Zero-Day

Leave a Reply

  • Required fields are marked *,
    Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>