Exploit targets IE7 hole patched a week ago
Published: 18 Feb 2009 09:17 GMT
Cybercriminals are exploiting a critical hole in Internet Explorer 7 that was patched a week ago by Microsoft, security firm Trend Micro warned on Tuesday.
The malicious code, which Trend Micro named 'XML_DLOADR.A', is hidden in a Word document. On unpatched systems, when the file is opened, an ActiveX object automatically accesses a website to open a backdoor that installs a .DLL (dynamic link library) file that can steal information, according to a Trend Micro blog entry. The code sends stolen data to another web address via port 443, Trend Micro said.
As a result of the back door, "anybody can run commands on the affected system", said Jamz Yaneza, a senior threat analyst and researcher at Trend Micro.
Microsoft released a security patch for the vulnerability, and others, a week ago. The vulnerability arises from the browser's improper handling of errors when attempting to access deleted objects.
"It looks like a proof of concept or targeted attack," Yaneza said. The exploit is similar to politically motivated attacks that were seen before the Olympics last year in which PDF files and Word documents contained exploit code and automatically connected computers to malicious websites, he said.
It appears that the site directed to is in China and there is Chinese terminology in the code, according to Yaneza. That and the fact that the 50th anniversary of the Tibetan uprising is approaching, on 10 March, suggests that this attack could be politically motivated as well, he said.
"People need to speed up how they patch their [operating systems], or turn on auto update in Windows," Yaneza said.
Credit: New exploit targets IE 7 hole patched last week from CNET News
Did you find this article useful?
47 out of 47 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
