September 25, 2006 4:50 PM PDT

Microsoft mulls early IE patch release

Related Stories

Security pros provide interim IE patch

September 22, 2006

E-cards used in data-thieving scam

September 21, 2006

Porn sites exploit new IE flaw

September 19, 2006

Attack code targets new IE hole

September 14, 2006
Microsoft may offer an Internet Explorer security update before its next official Patch Tuesday.

The update is being designed to fix a serious flaw in the way the widely used Web browser handles certain graphics files. The flaw, first reported last week, is increasingly being used in attacks on IE users, security experts warned Monday.

"We have been working nonstop on an update," a Microsoft representative wrote on a corporate blog Friday. The patch is being tested now, and if it is done before Microsoft's next scheduled patch release day on Oct. 10, the company will release it, the representative wrote.

Attacks that exploit the flaw have been broadening and now also use e-mail as a way to lure people to malicious Web sites, security company Websense said Monday. "We are starting to see mass mailing lures for Web sites that are hosting...exploit code," Websense said.

In one example, cybercrooks have adapted a scam that uses e-cards to also take advantage of this latest IE flaw. The scam involves e-mail messages that at first glance appear to be greeting cards, but clicking on the link to view the card sends the target to a malicious Web site that tries to silently install keystroke-logging software.

The vulnerability lies in a Windows component called "vgx.dll." This component is meant to support Vector Markup Language documents in the operating system. VML is used for high-quality vector graphics on the Web.

The IE flaw allows malicious software to be loaded onto a Windows PC unbeknownst to the user after clicking on a malicious link on a Web site or an e-mail message. Microsoft has also been monitoring the threat, but contrary to many security groups it has not seen widespread attacks. "Attacks remain limited," the Microsoft representative wrote.

While Microsoft works on the IE update, security company PatchLink on Monday said it has produced an unofficial fix for its customers. The PatchLink fix is the second third-party patch for the flaw. Microsoft does not recommend third-party fixes since they have not gone through the company's testing process.

Microsoft typically releases fixes each second Tuesday of the month, which has become known as Patch Tuesday. The last time the software maker rushed out a fix was in January, when another image-related flaw in IE was being used to compromise Windows PCs through malicious Web sites.

As attention focuses on the VML flaw, spyware specialist Sunbelt Software warned on Monday that another yet-to-be-patched IE flaw is now also being used by miscreants to load malicious software onto Windows PCs. This flaw is related to daxctle.ocx, an ActiveX control for multimedia features.

Microsoft provides work-arounds that protect against each of the IE flaws on its Web site. The software maker also recommends users keep their security software updated and take caution when browsing the Web.

See more CNET content tagged:
flaw, Websense Inc., representative, security company, malicious software

11 comments

Join the conversation!
Add your comment
Don't use IE, it's just a backdoor to the core..!!
Even if they patch it there will just be another hole found. IE is just
a backdoor to the core, if you want true security AVOID IE all
together..!!! There are alternative browsers and better yet
alternative OS's..!!!!
Posted by imacpwr (456 comments )
Reply Link Flag
So...
does anyone know anyone...that is actually getting attacked?

I dont, and I know a lot of people across the country that are in IT support.

I am not saying dont patch but all this hype over a flaw and I have not seen one real piece of anything about someone or some company getting hit by some code using the flaw.
Posted by Lindy01 (443 comments )
Reply Link Flag
And...
The answer is yes:

<a class="jive-link-external" href="http://isc.sans.org/diary.php?date=2006-09-25&#38;isc=9319a61308d6c92ec881bcdba85f4de5" target="_newWindow">http://isc.sans.org/diary.php?date=2006-09-25&#38;isc=9319a61308d6c92ec881bcdba85f4de5</a>

Astroturf is so gauche... ;)

/P
Posted by Penguinisto (5042 comments )
Link Flag
'attack' is such an overused word
they always make it sound like people are getting bombarded with missiles coming out of their cd trays when they open their email.

all these 'attacks' are is just typical phishing where some lifeless lump sends off a few emails with fake links looking for passwords. something anyone with half a brain knows how to avoid by using the simple method of 'hey, this isn't from someone i know. *delete*'

of course there are idiots out there who click on every link in every email they get, and suddenly someone has gotten their credit card number and is making fraudulent charges. nevermind the fact that almost all banks cover this and will refund the money and issue you a new number, because these victims are too idiotic to know any better. instead they make like their firstborn child has been kidnapped and make guest appearances on oprah, with dr phil telling them 'it's ok to be stupid, blame microsoft instead'
Posted by Sam Papelbon (242 comments )
Link Flag
Have you noticed...
They are a lot faster about patching when someone else beats them to it. They seem to patch much faster when someone else without the resources of MS (thousands of people) or even the source code to the DLL patches it first. Maybe a little public embarrasment is good for them.
Posted by amadensor (248 comments )
Reply Link Flag
Yep, though...
...they do patch at record speed when DRM vulnerabilities are involved, don't they? :)
Posted by Penguinisto (5042 comments )
Link Flag
Your best defense, avoid Microsoft products at all costs
For every MS product there is a better, safer alternative.
Posted by extinctone (214 comments )
Reply Link Flag
Maybe if IE had DRM installed on it...
...they'd have it patched faster?

:p

/P
Posted by Penguinisto (5042 comments )
Link Flag
MS finally releases patch
<a class="jive-link-external" href="http://www.microsoft.com/technet/security/Bulletin/" target="_newWindow">http://www.microsoft.com/technet/security/Bulletin/</a>
MS06-055.mspx
Posted by QuinzePrime (4 comments )
Reply Link Flag
But they mulled over it first...
Thus they aren't as security concious as they want us to believe.

If they were... there would be no mulling about this.

Security concious providers release Critical patches within 24 hours.

Something Microsoft has yet to do!!!

Walt
Posted by wbenton (522 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.