A malware attack was observed exploiting a new zero-day vulnerability in Internet Explorer, prompting Microsoft to issue an advisory.
Security researchers have uncovered a new Internet Explorer zero-day being used in malware attacks.
The situation was uncovered by Symantec after researchers observed a
limited spam campaign seeking to trick users into clicking on a link.
The spam had the subject line "re: hotel reservations," and posed as a
message about a hotel room. Once inside the e-mail, users were
greeted with a link leading to a page on a legitimate, but
"The link pointed to a page which contained a script looking to see
what version of the browser and Operating System the visitor was
using," explained Vikram Thakur
threat researcher at Symantec Security Response. "Since the specific
exploit page only worked when someone was using Internet Explorer 6 and
7, the script only transferred the visitor to the page hosting the
exploit when this condition was met. In other cases the users didn't
see anything but a blank website."
"Visitors who were served the exploit page didn't realize it, but
went on to download and run a piece of malware on their computer
without any interaction at all," Thakur blogged. "The vulnerability
allowed for any remote program to be executed without the end user's
According to Microsoft
the vulnerability in question exists due to an invalid flag reference
within Internet Explorer. Under certain conditions, the invalid flag
reference can be accessed after an object is deleted. In attempting to
access a freed object, the browser can open users up to remote code
execution, according to Microsoft's advisory.
In the attack discovered by Symantec, the malware--a backdoor Trojan dubbed Pirpi-
itself to start up with the computer along with a service named
"NetWare Workstation." The Trojan, which targets Windows
computers, installs a backdoor and reaches out to remote
"It tries to contact a specific server hosted in Poland for small
files named with a .gif extension," Thakur blogged. "These small files
are actually encrypted files with commands telling the Trojan what to
"The files being downloaded by the attacker were hosted on yet
another hacked Website," the researcher continued. "The owners of this
server were also unaware of their computer being involved in hosting of
malicious programs...(and) immediately took down the malicious content."
The IE vulnerability impacts IE 6, 7 and 8, Microsoft noted, but
there are mitigations. Data Execution Prevention (DEP) protects against
code execution and is enabled by default in IE 8 on Windows XP Service
Pack 3, Windows Vista Service Pack 1, Windows Vista Service Pack 2, and
Windows 7. Additionally, Protected Mode in Internet Explorer on Windows
Vista and later Windows versions limits the impact of the attack.
"On completion of this investigation, Microsoft will take the
appropriate action to protect our customers, which may include
providing a solution through our monthly security update release
process, or an out-of-cycle security update, depending on customer
needs," Microsoft said in its advisory.