Researcher publishes exploit for new IE hole
Moshe Ben Abu announced his Internet Explorer exploit on Twitter.
(Credit:
Twitter)
An Israeli security researcher has published exploit code for an unpatched hole in Internet Explorer that Microsoft disclosed two days ago.
Microsoft had warned in an advisory that a new vulnerability in IE 6 and IE 7, which could allow an attacker to take control of a computer, had been targeted in attacks.
Releasing the exploit code publicly increases the chances of attacks on the zero-day hole and could pressure Microsoft to issue a patch before its next scheduled Patch Tuesday in four weeks.
Researcher Moshe Ben Abu announced his work in a blog post on Wednesday and said it was being included in the open-source Metasploit exploit database.
He was able to create the exploit code after figuring out where an existing exploit was in the wild, based on information in a McAfee blog post, he told Ryan Naraine of the Zero Day blog at CNET sister site ZDNet. It took him about 10 minutes to de-obfuscate the exploit and pinpoint the vulnerability, he said.
Ben Abu told CNET that he would have found the original exploit code sooner or later without McAfee’s help.
Asked how serious the zero-day hole is, he wrote in an e-mail to CNET: “The exploit covers Internet Explorer versions 6 and 7, which are not the latest version [IE 8] but many users still use it. In addition, the exploit is quite unstable, with about 60 percent to 70 percent success rate. So I guess it is critical, but not for users who update their Windows with the latest IE.”
Microsoft’s advisory on the vulnerability includes information on workarounds but suggests that IE 6 and IE 7 users upgrade to IE 8 immediately.
Updated at 1:37 p.m. EST with comment from Ben Abu.
Originally posted at InSecurity Complex
Go To The Site We Found The Info
