IE7 0-Day Vulnerability Published in the Wild

Details on a zero-day vulnerability affecting Internet Explorer are currently available in the wild, having been published to the BugTraq mailing list last week. So far, Microsoft has not commented on the exploit code made available in the wild, but security company Symantec has confirmed that it is fully functional. According to the security outfit, the exploit successfully targets a vulnerability in both Internet Explorer 7 and Internet Explorer 6. Apparently the flaw can be better exploited in the context in which attacks use IE7 and IE6 on older versions of Windows, pre-Windows Vista, as avenues for attacks.

“The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future. When this happens, attackers will have the ability to insert the exploit into Web sites, infecting potential visitors. For an attacker to launch a successful attack, they must lure victims to their malicious Web page or a Web site they have compromised. In both cases, the attack requires JavaScript to exploit Internet Explorer,” Symantec noted.

According to details shared by Symantec’s Security Intel Analysis team, the new 0-day IE vulnerability is associated with the way Microsoft’s browser handles Cascading Style Sheets. CSS is an extremely popular style sheet language that web developers can leverage in order to control the look and feel, as well as the formatting for websites.

“Symantec currently detects the exploit with the Bloodhound.Exploit.129 antivirus signature and is working on new signatures now. Symantec IPS protection also currently detects this exploit with signatures HTTP Microsoft IE Generic Heap Spray BO and HTTP Malicious Javascript Heap Spray BO. A new IPS signature, HTTP IE Style Heap Spray BO, has also been created for this specific exploit. To minimize the chances of being affected by this issue, Internet Explorer users should ensure their antivirus definitions are up to date, disable JavaScript and only visit Web sites they trust until fixes are available from Microsoft,” Symantec added.