Attack code linked to the Internet Explorer vulnerability exploited by hackers in recent cyber-attacks against dozens of companies is circulating on the Internet.
Attack code targeting the Internet Explorer vulnerability used to hit Google
and other companies has hit the Web.
According to McAfee, researchers have seen references to the code-which
exploits an unpatched vulnerability in Microsoft Internet Explorer-on mailing
lists and have confirmed that the code was published on at least one Website.
The code was used to attack Google and others in a
spate
of cyber-attacks believed to have originated in China.
The attacks have sparked controversy and prompted
Google
to threaten to pull out of China altogether. Officials at the U.S. State
Department have stated they plan
to
get answers from China as to what happened in the coming days.
"The public release of the exploit code increases the possibility of
widespread attacks using the Internet Explorer vulnerability,"
McAfee
CTO George Kurtz posted on the McAfee Security Insights blog. "The now
public computer code may help cyber-criminals craft attacks that use the
vulnerability to compromise Windows systems. Popular penetration-testing tools
are already being updated to include this exploit. This attack is especially
deadly on older systems that are running [Windows] XP and Internet Explorer 6."
Microsoft
stated in an advisory that though the attacks have been focused on IE 6,
versions 7 and 8 are vulnerable as well. The vulnerability, the company said,
is due to an invalid pointer reference in IE.
"It is possible under certain conditions for the invalid pointer to be
accessed after an object is deleted," the Microsoft advisory said. "In
a specially crafted attack, in attempting to access a freed object, Internet
Explorer can be caused to allow remote code execution."
To mitigate the problem, users can enable DEP (data execution protection) or
disable active scripting in the Internet and Local Intranet security zones.
Users can also configure Internet Explorer to prompt before running active
scripting.
Email
Print
