Microsoft Issues Advisory on Internet Explorer Bug -- Redmondmag.com

Microsoft Warns of IE Bug on Windows XP

By Jabulani Leffall
02/04/2010

Internet Explorer continues to be a target of unpatched exploits as Microsoft released yet another security advisory for IE on Wednesday, mostly applying to Windows XP users.

According to the advisory, the software giant is investigating a new publicly reported bug affecting IE versions 5 to 8 on Windows XP and Windows Server 2003 Service Pack 2. The fix applies to IE browsers that aren't configured by default to run in "protected mode" or that have that function turned off.

Microsoft's advisory also applies to IE 5.01 SP4 on Windows 2000 SP4, as well as to IE 6 SP1 on Windows 2000 SP4.

This vulnerability typically doesn't apply when running IE on Windows Vista or Windows 7 because those operating systems use protected mode by default, according to a Microsoft blog. The blog noted that Microsoft has already issued a "Fix it" automated patch to help individual users enable protected mode on XP systems.

"Windows XP users, or users who have disabled Protected Mode, can help protect themselves by implementing Network Protocol Lockdown," the blog explains. "We have created a Microsoft Fix It to automate this. The Fix It can be run on individual systems or enterprises can deploy it through their automated systems."

The bug in question would still require that users be directed to a malicious Web site in order for the exploit to happen. A hacker could gain the same local user rights as the IE user if an attack is carried out successfully. Limiting user rights on the system thus can be a helpful way to lessen an attack's impact.

Redmond may release a patch for this bug in its monthly security update, coming next Tuesday, or issue an out-of-band patch. Microsoft already issued an out-of-band fix for IE in January to address a remote code execution bug that led to attacks on Google and other companies.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

Using Configuration Files to Control PowerShell Scripts, Part 2: Building Blocks

Learn how to use PowerShell's GUI capabilities to dynamically create configuration files that enhance script flexibility and usability.
U.S. House Leaders Unveil Bipartisan Strategy for AI Governance and Innovation

On Tuesday, U.S. House Speaker Mike Johnson and Democratic Leader Hakeem Jeffries received the final report from the bipartisan House Task Force on Artificial Intelligence, which outlines essential principles and recommendations to bolster American leadership in AI.
Using Configuration Files to Control PowerShell Scripts, Part 1: The Basics

Learn how to use JSON configuration files to make PowerShell scripts more dynamic, flexible and user-friendly.
Exchange Online Receiving Enhanced Message Trace

Microsoft has announced the public preview of its enhanced Message Trace feature in the Exchange admin center (EAC) for Exchange Online.
Major Microsoft Multifactor Authentication Vulnerability Revealed

A vulnerability in Microsoft’s multifactor authentication (MFA) system has been uncovered by cybersecurity firm Oasis Security, allowing attackers to bypass security measures and access sensitive data across services including Outlook, OneDrive, Teams and Azure.