Microsoft has issued a pre-patch advisory with workarounds for a “highly critical” vulnerability that could put millions of Internet Explorer users at the mercy of malicious hackers.
The advisory confirms the existence of a code execution hole that was discovered and publicly reported by Secunia Research of Copenhagen, Denmark.
“When Internet Explorer displays a Web page that contains certain unexpected method calls to HTML objects, system memory may be corrupted in such a way that an attacker could execute arbitrary code,” the software maker said.
Separately, the SANS ISC (Internet Storm Center) warned that a proof-of-concept code has already been unleashed that could be easily modified into a dangerous exploit.
The ISCs threat meter has been raised to “yellow” to sound alarm bells for what is deemed a “significant” new threat./p>
Secunia said in an alert that the vulnerability is due to an error in the processing of the “createTextRange()” method call applied on a radio button control.
“This can be exploited by a malicious Web site to corrupt memory in a way that allows the program flow to be redirected to the heap,” Secunia said in the alert, warning that successful exploitation allows execution of arbitrary code whenever the target visits the rigged Web site.
/zimages/1/28571.gifMicrosoft hunts down new Internet Explorer bug.Click hereto read more.
The vulnerability was confirmed on a fully patched system with IE 6.0 and Microsoft Windows XP SP2. It has also been confirmed in IE 7 Beta 2 Preview, Secunia said.
The MSRC (Microsoft Security Response Center) said in a blog entry that users of the new refresh of the IE7 Beta 2 Preview announced at Mix 06 are not affected.
Lennart Wistrand, a program manager in the MSRC, recommended that IE users turn off Active Scripting to prevent a possible attack.
“Customers who use supported versions of Outlook or Outlook Express arent at risk from the e-mail vector since script doesnt render in mail [being read in the restricted sites zone],” Wistrand added.
The latest warning comes just 24 hours after the discovery, and public release, of a denial-of-service bug in the dominant Web browser.
Editors Note: This story has been updated to include a pointer to Microsofts advisory and new information on the publication of exploit code.
/zimages/1/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.