With Patch Tuesday looming, Microsoft is investigating new reports of a zero-day vulnerability impacting Internet Explorer.
Exploit code for the vulnerability was posted Dec. 8 on the Full Disclosure mailing list. The bug affects Internet Explorer versions 6, 7 and 8 across multiple versions of Windows, including Windows 7 and Windows Vista.
There is no patch currently available for the bug. According to an analysis by security firm VUPEN Security, the vulnerability could be used by attackers to take complete control of a vulnerable system.
“This issue is caused by a use-after-free error within the ‘mshtml.dll’ library when processing a web page referencing a CSS (Cascading Style Sheets) file that includes various ‘@import’ rules, which could allow remote attackers to execute arbitrary code via a specially crafted web page,” according to VUPEN, which rated the vulnerability “critical.” “VUPEN has confirmed this vulnerability with Microsoft Internet Explorer 8 on Windows 7, Windows Vista SP2 and Windows XP SP3, and with Internet Explorer 7 and 6 on Windows XP SP3.”
On Dec. 14, Microsoft plans to release its final Patch Tuesday security update for the year, complete with 17 security bulletins and 40 security fixes. Included in there is a fix for another IE bug that the company first warned users about in November after attackers began pounding it with attacks.
The 17 security bulletins break a record for the company, though its current high for vulnerabilities patched in an update-49, a mark set in October-looks like it will remain untouched.
Jerry Bryant, group manager of response communications at Microsoft, said the company is unaware of any attacks targeting the latest IE bug.
“Once we’re done investigating, we will take appropriate action to help protect customers,” he said. “This may include providing a security update through the monthly release process, an out-of-cycle update or additional guidance to help customers protect themselves.”