Microsoft Releases Security Advisory 2488013

22 Dec 2010 3:27 PM

Press Release from Microsoft Security Response Centre

Today we released Security Advisory 2488013 to address a public vulnerability that could affect customers using Internet Explorer 6, 7 and 8 if they visit a website hosting malicious code. Currently the impact of this vulnerability is limited and we are not aware of any affected customers or active attacks targeting customers.

Internet Explorer Protected Mode on Windows Vista and later versions of Windows helps to limit the impact of the currently known proof-of-concept exploits. Protected Mode is on by default in the Internet and Restricted sites zones in Internet Explorer 7 and 8 and prompts users before allowing software to install, run or modify sensitive system components.

The Security Advisory includes additional workarounds and mitigations that will help protect customers. Our Security and Research team has written a detailed blog post on the more technical aspects.

We initiated our Software Security Incident Response Process (SSIRP) to manage this issue and are sharing detailed information through the Microsoft Active Protections Program (MAPP). Our 70 global MAPP partners, including leading providers of anti-virus and anti-malware products, provide protections for an estimated one billion customers worldwide. With our partners, Microsoft is actively working to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability. If your protection provider is in our MAPP program, you can contact them concerning the status of providing protections for this issue as it is likely that updated malware signatures in these products will offer further protection.

We are working to develop a security update to address this attack against our customers. The issue does not currently meet the criteria for an out-of-band release. However, we are monitoring the threat landscape very closely and if the situation changes, we will post updates here on the MSRC blog.

As always, we encourage Internet users to follow the "Protect Your Computer" guidance of enabling a firewall, applying all software updates and installing anti-virus and anti-spyware software. Additional information can be found at Security at Home.

Thanks,

Carlene Chmaj

Microsoft Trustworthy Computing, Senior Response Communications Manager

The BBC had this to say about the problem. 

Microsoft has issued a warning about a serious vulnerability in all versions of its Internet Explorer (IE) browser.

If exploited by a booby-trapped webpage the bug would allow attackers to take control of an unprotected computer.

Read more..