Exploit Posted for New IE Zero-Day

Security researchers in China have published detailed exploit code for a new zero-day vulnerability in Microsofts dominant Internet Explorer browser.

The exploit, which was posted to XSec.org and Milw0rm.com Web sites, could be easily modified to launch code execution attacks without any user action on fully patched Windows machines.

A spokesman for the MSRC (Microsoft Security Response Center) said the company is investigating the latest warning, which adds to a list of known high-risk vulnerabilities that remain unpatched.

According to notes embedded in the exploit code, the flaw is a COM Object heap overflow that was tested and confirmed on Chinese-language versions of IE 6.0 running on Windows XP SP2 and Windows Server 2000 SP4.

Malicious hackers typically use code execution browser bugs to launch drive-by attacks to load Trojans, bots and other forms of malware on Windows computers.

Roger Thompson, chief technical officer at Atlanta-based Exploit Prevention Labs, said he was able to use the code to simulate an attack but noted that the exploit was not always reliable.

In an interview with eWEEK, Thompson said the exploit managed to crash fully patched versions of the browser and could be easily modified to work in targeted attacks.

Why did Microsoft delay IE patch? Click here to read more.

Thompson has added detection signatures to his companys SocketShield, an application that serves as a zero-day exploit blocker.

"Its worth knowing about and monitoring, in case someone improves it. But its not a huge threat as it stands," Thompson said.

The latest published exploit comes at a sensitive time for Microsofts IE product team. A cumulative IE update that shipped in the August batch of patches had to be re-released twice because of two separate flaws that were introduced into the browser by the original patch.

According to vulnerability statistics from security alerts aggregator Secunia, about 30 percent of IE flaws reported in 2006 remain without patches.

Based on 13 advisories issued by Secunia this year, roughly 60 percent of all reported IE bugs were rated "highly critical" or "extremely critical."

Microsoft has shipped four bulletins for IE in 2006, all rated "critical."

Editors Note: This story was updated to include additional information from Microsoft.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.