Security threats Toolkit

Microsoft may rush out IE patch

Tags:
IE Flaw,
Microsoft,
Flaw

Joris Evers CNET News

Published: 26 Sep 2006 09:55 BST

Microsoft may offer an Internet Explorer security update before its next official Patch Tuesday.

The update is being designed to fix a serious flaw in the way the widely used web browser handles certain graphics files. The flaw, first reported last week, is increasingly being used in attacks on IE users, security experts warned on Monday.

A Microsoft representative wrote on a corporate blog on Friday: "We have been working non-stop on an update." The patch is being tested now, and if it is done before Microsoft's next scheduled patch release day on 10 October, the company will release it, the representative wrote.

Attacks that exploit the flaw have been broadening and now also use email as a way to lure people to malicious websites, security company Websense said on Monday. "We are starting to see mass mailing lures for websites that are hosting... exploit code," Websense said.

In one example, cyber crooks have adapted a scam that uses e-cards to also take advantage of this latest IE flaw. The scam involves email messages that at first glance appear to be greeting cards but clicking on the link to view the card sends the target to a malicious website that tries to silently install keystroke-logging software.

The vulnerability lies in a Windows component called 'vgx.dll'. This component is meant to support Vector Markup Language documents in the operating system. VML is used for high-quality vector graphics on the web.

The IE flaw allows malicious software to be loaded onto a Windows PC unbeknown to the user after clicking on a malicious link on a website or an email message. Microsoft has also been monitoring the threat but contrary to many security groups it has not seen widespread attacks. The Microsoft representative wrote: "Attacks remain limited."

While Microsoft works on the IE update, security company PatchLink on Monday said it has produced an unofficial fix for its customers. The PatchLink fix is the second third-party patch for the flaw. Microsoft does not recommend third-party fixes since they have not gone through the company's testing process.

Microsoft typically releases fixes each second Tuesday of the month, which has become known as Patch Tuesday. The last time the software maker rushed out a fix was in January, when another image-related flaw in IE was being used to compromise Windows PCs through malicious websites.

As attention focuses on the VML flaw, spyware specialist Sunbelt Software warned on Monday that another yet-to-be-patched IE flaw is now also being used by miscreants to load malicious software onto Windows PCs. This flaw is related to daxctle.ocx, an ActiveX control for multimedia features.

Microsoft provides workarounds that protect against each of the IE flaws on its website. The software maker also recommends users keep their security software updated and take caution when browsing the web.