News Articles

Microsoft IE zero-day vulnerability and exploit threatens windows security

A new exploit targeting zero-day vulnerability on Internet Explorer was published to the BugTraq mailing list recently, according to various reports. The exploit reportedly affects both IE 6 and 7 on Windows XP and Vista platforms, but there are possibilities that other versions of IE and Windows may also be affected. The vulnerability is the result of a dangling pointer in IE and there is a working exploit for the flaw circulating online, although it is said to exhibit inconsistent behaviors thus far. The flaw lies in the way that Internet Explorer handles CSS data. CSS is a technology that's used in many sites to help present information in an organized manner. Specifically, the vulnerability is in the mshtml.dll, the Microsoft HTML Viewer, Threat Post reported. For an attacker to launch a successful attack, they must lure victims to their malicious webpage or a website they have compromised. In both cases, the attack requires JavaScript to exploit Internet Explorer.