Microsoft warns of new IE threat

Days after Patch Tuesday, Microsoft warned of a new threat against Internet Explorer. Attackers could exploit it to crash machines or take them over.

Just days after releasing its monthly patch update, Microsoft warned Thursday of a new Internet Explorer flaw attackers

could exploit to crash machines or take them over.

"Microsoft is investigating new public reports of a vulnerability [that] may allow an attacker to execute code on a user's machine by convincing them to visit a malicious Web site using Internet Explorer," a Microsoft spokesman said in an email. The software giant confirmed exploit code has been publicly released but said it is not aware of any attacks attempting to use it.

More on Microsoft patches
Microsoft releases 13 security patches

Windows patch problems to force out-of-cycle repair
Microsoft has released an advisory outlining steps users can take to protect their machines.

The French Security Incident Response Team (FrSIRT) said in an advisory that the flaw is due to a memory corruption error when processing a specially crafted argument passed to the "KeyFrame()" method of a "DirectAnimation.PathControl" (daxctle.ocx) ActiveX object. Attackers could exploit this condition to cause a denial of service or launch malicious commands by convincing a user to visit a malicious Web page.

FrSIRT said it successfully exploited the security hole on a fully patched Windows XP SP2 system.

To mitigate the threat, IT administrators should only allow trusted Web sites to run ActiveX controls, Danish vulnerability clearinghouse Secunia said in an advisory. FrSIRT recommended administrators disable Active Scripting in the Internet and local intranet security zones, though certain Web sites won't work properly if this is done.

The appearance of a new exploitable flaw immediately after Microsoft's monthly patch release has become a familiar pattern.

After the July patch release, a new zero-day flaw was found in Microsoft PowerPoint. After the June patch release, a Microsoft Excel zero-day flaw surfaced.

This article originally appeared on SearchSecurity.com.

Dig deeper on Enterprise information security management

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCompliance

SearchHealthIT

SearchCloudComputing

SearchMobileComputing

SearchDataCenter

Close