Exploit code for a critical flaw in fully patched versions of Microsoft Corp.s Internet Explorer browser has been released on the Internet, putting millions of Web surfers at risk of computer hijack attacks.
The zero-day exploit, posted by a U.K.-based group called “Computer Terrorism,” could allow a remote hacker to take complete control of a Windows system if the victim simply browses to a malicious Web site.
Ziff Davis Internet News have verified that the exploit works on fully patched Windows XP systems with default IE installations.
The MSRC (Microsoft Security Response Center) is expected to release a security advisory to address the public reports.
A Microsoft spokeswoman acknowledged that customers running Windows 2000 SP4 and Windows XP SP2 were at risk. The Windows Server 2003 and Windows Server 2003 SP1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected.
“We have also been made aware of proof of concept code that could seek to exploit the reported vulnerability but are not aware of any customer impact at this time but Microsoft will continue to investigating these public reports,” the spokeswoman added.
The proof-of-concept exploit, which is available from the FrSirt site, currently launched the Windows Calculator (calc.exe) but can be easily modified by malicious hackers.
Johannes Ullrich, chief technology officer at the SANS ISC (Internet Storm Center), warned that arbitrary executables may be launch without user interaction. An attacker must however lure the victim to visit a maliciously crafted Web site.
Ullrich said the ISC has already received reports that a new version of the exploit is capable of opening a remote shell. “The PoC exploit allows for easy copy/paste of various shell code snippets,” he warned.
Benjamin Tobias Franz, a German security researcher, originally published an advisory in May this year to warn of the denial-of-service bug.
However, according to the latest findings, the issue is much more serious and could allow remote, arbitrary code execution, yielding full system access with the privileges of the underlying user, according to a notice from Computer Terrorism (U.K.) Ltd.
The group said IE users should immediately disable “Active Scripting via the Tools > Internet Options > Security tab > Custom Level feature.
The SANS ISCs Ullrich said IE users should consider switching to Firefox or Opera.