Internet Explorer vulnerability: panic, or don't panic?

Stephen Withers
Tuesday, 19 January 2010 09:58

Business IT - Security

While some European governments are recommending users abandon Internet Explorer in the light of the current security scare, Microsoft and some security vendors question the value of such a move.

Late last week, Microsoft issued a security advisory concerning real-world attacks on a vulnerability in Internet Explorer.

There has been speculation that this vulnerability - along with one in Acrobat and Reader that Adobe patched last week - was used in December's China-based attacks on Google and more than 30 other US companies.

Amichai Shulman, CTO of Imperva doubts this was the case.

"First, why are Google employees using IE and not Google's own browser, Chrome? This doesn't make sense," he said.
 
"Second, to execute an attack this sophisticated, it likely occurred as a result of spear phishing Google employees to gain access to Google users credentials. A hacker would have to jump through many hoops inside an internal network. This requires network — not browser — vulnerabilities so that the attacker can communicate with malware inside Google's internal network," added Shulman.

Microsoft has explained that Internet Explorer 6 is the only version affected by the exploit, which was subsequently made public.

Internet Explorer 7 on Windows XP has the same vulnerability, but a different exploit is needed due to memory layout differences between the two browser versions.

IE protected mode in Vista and Windows 7 prevents the current exploit from working, as does DEP (data execution prevention) in Internet Explorer 8.

DEP is enabled by default when Internet Explorer 8 is running on Windows XP SP3, Vista SP1 (and higher), or Windows 7.

DEP can be manually activated in Windows XP SP2, Windows Server 2003 SP2 (and higher), Windows Server 2008, and the release version of Vista by following this link to Microsoft's web site.

Which governments are advising users to abandon Internet Explorer, and what is Microsoft's response? Find out on page 2.