Microsoft Talks Up Countermeasures to Fend Off IE Attacks

Microsoft warned users of Internet Explorer 7 (IE7) late Wednesday that attackers are actively exploiting a critical bug in the browser, and urged them to take countermeasures in lieu of a patch.

By Gregg Keizer, Computerworld (US)

December 12, 2008 — CSO — Microsoft Talks Up Countermeasures to Fend Off IE Attacks Microsoft warned users of Internet Explorer 7 (IE7) late Wednesday that attackers are actively exploiting a critical bug in the browser, and urged them to take countermeasures in lieu of a patch.

In a late-Wednesday security advisory, Microsoft officially acknowledged the flaw. "We are aware only of limited attacks that attempt to use this vulnerability," the company said, adding that users running IE7 in Windows XP , Windows Vista , Windows Server 2008 and Windows Server 2008 are at risk.

As is its practice, however, the company was vague about whether it would patch the problem, and if so, when. "On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs."

The last time that Microsoft went off its usual once-a-month security update schedule was in late October, when it issued an emergency patch for a bug in Windows that was also being exploited in the wild.

In one way, Microsoft downplayed the threat posed by the IE7 bug, which independent researchers have said is in a browser rendering component, and is triggered by misuse of the HTML "span" tag.

"Our investigation of these attacks so far has verified that they are not successful against customers who have applied the workarounds listed in this advisory," Microsoft said. "Additionally, there are mitigations that increase the difficulty of exploiting this vulnerability."

The company spelled out three things IE7 users can do to protect themselves:

- Set "Internet" and "Local internet" security zones to "high." To do that, users must select "Internet Options" from the Tools menu, click the Security tab, click on "Internet," then move the slider to the "High" setting. Repeat for "Local intranet." Click OK.

- Disable Active Scripting. Choose "Internet Options" from the Tools menu, click the Security tab, click the "Internet" icon and then the "Custom level" button. In the ensuing dialog, under the "Scripting" section, in the "Active scripting" item, click "Disable," then OK.

- Enable DEP (data execution prevention). Select "Internet Options" from the Tools menu, click the Advanced tab, then check "Enable memory protection to help mitigate online attacks." Click OK.

Although multiple exploits have surfaced, all are effective against only IE7. Researchers, including those at Microsoft, are still investigating whether the older IE6 also contains the same vulnerability.

• Print