From: InfoSec News (alertsinfosecnews.org)
Date: Tue Sep 26 2006 - 01:50:15 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://news.com.com/Microsoft+mulls+early+IE+patch+release/2100-1002_3-6119393.html

By Joris Evers
Staff Writer, CNET News.com
September 25, 2006

Microsoft may offer an Internet Explorer security update before its next
official Patch Tuesday.

The update is being designed to fix a serious flaw in the way the widely
used Web browser handles certain graphics files. The flaw, first
reported last week, is increasingly being used in attacks on IE users,
security experts warned Monday.

"We have been working nonstop on an update," a Microsoft representative
wrote on a corporate blog Friday. The patch is being tested now, and if
it is done before Microsoft's next scheduled patch release day on Oct.
10, the company will release it, the representative wrote.

Attacks that exploit the flaw have been broadening and now also use
e-mail as a way to lure people to malicious Web sites, security company
Websense said Monday. "We are starting to see mass mailing lures for Web
sites that are hosting...exploit code," Websense said.

In one example, cybercrooks have adapted a scam that uses e-cards to
also take advantage of this latest IE flaw. The scam involves e-mail
messages that at first glance appear to be greeting cards, but clicking
on the link to view the card sends the target to a malicious Web site
that tries to silently install keystroke-logging software.

The vulnerability lies in a Windows component called "vgx.dll." This
component is meant to support Vector Markup Language documents in the
operating system. VML is used for high-quality vector graphics on the
Web.

The IE flaw allows malicious software to be loaded onto a Windows PC
unbeknownst to the user after clicking on a malicious link on a Web site
or an e-mail message. Microsoft has also been monitoring the threat, but
contrary to many security groups it has not seen widespread attacks.
"Attacks remain limited," the Microsoft representative wrote.

While Microsoft works on the IE update, security company PatchLink on
Monday said it has produced an unofficial fix for its customers. The
PatchLink fix is the second third-party patch for the flaw. Microsoft
does not recommend third-party fixes since they have not gone through
the company's testing process.

Microsoft typically releases fixes each second Tuesday of the month,
which has become known as Patch Tuesday. The last time the software
maker rushed out a fix was in January, when another image-related flaw
in IE was being used to compromise Windows PCs through malicious Web
sites.

As attention focuses on the VML flaw, spyware specialist Sunbelt
Software warned on Monday that another yet-to-be-patched IE flaw is now
also being used by miscreants to load malicious software onto Windows
PCs. This flaw is related to daxctle.ocx, an ActiveX control for
multimedia features.

Microsoft provides work-arounds that protect against each of the IE
flaws on its Web site. The software maker also recommends users keep
their security software updated and take caution when browsing the Web.

_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]