Blueprints showing attackers how to exploit a previously unknown security hole in versions of Microsoft's Internet Explorer browser recently were published online. The danger here is if IE users browse to a hacked or booby-trapped Web site that uses the exploit, that site could install malicious software.
Microsoft has not yet issued an advisory about this threat. According to initial reports from Symantec and vulnerability management firm VUPEN, the exploit works against IE 6 and IE 7 versions only. The vulnerability apparently resides in the way IE handles so-called cascading style sheet information (CSS), which a great many Web sites use to control the design and formatting of text and other site elements.
Symantec reports that the attack code is a bit buggy and unreliable at the moment, but that a fully-functional and more reliable exploit almost certainly will be released soon. Symantec advises IE users is to make sure anti-virus software is installed, to disable Javascript and only visit trusted Web sites until Microsoft issues a patch.
But as I've noted frequently, the advice to avoid untrusted Web sites is tad hollow in a world in which a fair percentage of the malicious sites out there are legitimate sites that have been hacked or otherwise compromised. Consider what would happen if a tainted banner ad containing this exploit were to run on a series of high-traffic Web sites (a la the bad ads that ran on the New York Times' site earlier this year).
Now might be an excellent time for diehard IE users to either upgrade to IE8, or to try out another browser, such as Firefox or Opera. Firefox, combined with either the Noscript or Request Policy add-ons, goes a long way toward helping users insulate themselves from these types of malicious scripting attacks.
