Microsoft releases critical Internet Explorer patch

Not a moment too soon. Microsoft has released an out-of-band security update, MS08-078, to fix a vulnerability in its Internet Explorer Web browser which is being actively exploited by hackers. “At this time, we are aware only of attacks that attempt to use this vulnerability against Windows Internet Explorer 7,” said Christopher Budd, Microsoft security response communications lead, in an e-mailed statement. “Our investigation of these attacks so far has verified that they are not successful against customers who have applied the security update. MS08-078 has a maximum severity rating of Critical for all versions of Internet Explorer.”

InformationWeek’s Thomas Claburn writes that the security patch notwithstanding, Microsoft still lists Internet Explorer 5.01, 6, and 7 as affected software in its Security Bulletin. It also says, separately in the FAQ section, that Internet Explorer 8 Beta 2 is affected. The vulnerability can be exploited through avaScript code posted on malicious Web sites. Internet Explorer users may be redirected to these sites through hacked legitimate sites. If the malicious code is successful, it silently downloads malware onto the victim’s computer.

Claburn notes that Microsoft typically releases software patches, referred to as Security Bulletins, on the second Tuesday of every month. When critical vulnerabilities emerge and are actively exploited, Microsoft often issues a patch as soon as it is ready. The last such out-of-band patch, Microsoft Security Bulletin MS08-067, was released on 23 October. It addressed a vulnerability in Windows Server service that affected all currently supported versions of Windows. That vulnerability allowed an attacker to take over affected computers remotely.

The out-of-band October patch release was explained by the vulnerability’s potential “wormability,” that is, the hole could be exploited on a massive scale using self-copying malware. MS08-078 is not wormable, however. “[That] shows that the wormability of a vulnerability is no longer a good indicator of the seriousness of a threat and that these Web-based threats are now much more dangerous than network worms,” said Roel Schouwenberg, senior antivirus researcher for Kaspersky Lab, Americas.

Microsoft security researchers estimated that as many as 1 in 500 users of Internet Explorer could have been exposed to malware attempting to exploit the flaw.