Internet Explorer patch due Friday (Australian time)

Stephen Withers
Thursday, 21 January 2010 02:41

Business IT - Security

Microsoft's promised 'out-of-band' security update for Internet Explorer is set for release early Friday morning, Australian time.

Microsoft has now announced that its promised out-of-band security update for Internet Explorer will be released at approximately 10am on January 21 USPST, which is 5am on January 22 AEDST.

Microsoft has also confirmed that the vulnerability addressed by this patch was used in last month's attacks on Google and other companies. At least one exploit has been made publicly available.

According to Microsoft officials, attacks are still limited and are only known to be successful against Internet Explorer 6.

DEP (data execution prevention) is a current mitigation of this issue, but Microsoft has revealed the existence of private proof-of-concept code that allows reliable arbitrary code execution with Internet Explorer 7 on Windows XP, and commercial proof-of-concept code that has a one-in-three chance of arbitrary code execution with Internet Explorer 8 on XP.

There are said to be no known proofs-of-concept for Internet Explorer 8 on Vista or Windows 7, and Microsoft estimates that developments of current exploits for these operating systems would have a success rate of less than 1% (thanks to the use of address space layout randomisation), with the browser crashing on the remaining occasions.

Microsoft has also warned that other products using Internet Explorer's HTML rendering engine may also be vulnerable.

Which products are they? See page 2 .