Microsoft patching critical Internet Explorer security hole

▤ Summary

Microsoft today announced it will issue an emergency security update for Internet Explorer (IE) tomorrow to patch a zero-day vulnerability that has been used to launch drive-by attacks for at least several weeks. Microsoft first warned users of the vulnerability in IE6 and IE7 on March 9, saying at the time that the bug didnt affect the browsers oldest and newest editions, IE 5.01 and IE8, respectively. Within two days, hackers were spotted using the vulnerability to conduct drive-by attacks from malicious sites, and an Israeli researcher had published exploit code on the Internet. Microsoft may patch two other outstanding vulnerabilities in IE, Storms added, ticking off a pair of security advisories the company has issued this year. In February, Microsoft warned of a bug in IE running on Windows XP that could be used by hackers to access files on the PC; earlier this month, Microsoft told Windows XP users not to press the F1 key when prompted by a website, citing an unpatched vulnerability that attackers could exploit to hijack PCs running the browser.

▦ Linked Companies

Microsoft

$1B+