REDMOND – Microsoft said it is investigating a possible vulnerability in Internet Explorer after exploit code that allegedly can be used to take control of computers, if they visit a Web site hosting the code, was posted to a security mailing list.
Microsoft confirmed that the exploit code affects IE 6 and IE 7, but not IE 8, and it said it is “currently unaware of any attacks trying to use the claimed vulnerability or of customer impact,” according to a statement, CNET News.Com.
The exploit code was published to the BugTraq mailing list with no explanation.
“The exploit targets a vulnerability in the way Internet Explorer uses Cascading Style Sheet (CSS) information. CSS is used in many Web pages to define the presentation of the sites’ content,” Symantec wrote in a blog post.
“The exploit currently exhibits signs of poor reliability, but we expect that a fully functional, reliable exploit will be available in the near future,” Symantec said. Symantec urges IE users to keep their antivirus software up-to-date, disable JavaScript, and visit only trusted Web sites, until Microsoft issues a patch for the hole.
In July, critical holes in IE prompted Microsoft to issue a rare out-of-cycle (in other words, pre-Patch Tuesday) fix.
a>>
