15/12/2008 Article posted by Paul Falla, Searchsmart Research & Development Manager
We have just had notification that there are a number of severe security flaws in the latest versions of the Internet Explorer web browser. Can you please ensure as a matter of urgency that you use either Mozilla firefox or Google Chrome as your internet browsers for the foreseeable future. The Safari browser should also be fine to use
I will advise further once more information from Microsoft becomes available. The full story is below:
Attackers have recently begun exploiting a previously unknown and presently unpatched flaw in Microsoft’s Internet Explorer 7 (IE7) web browser. In the field of computer security, this is referred to a “zero-day” vulnerability.
Exploitation of this flaw leads to complete compromise of the targeted computer. This vulnerability is triggered when IE7 views a specially crafted web site.
Some of you may be aware of public reports regarding this vulnerability, particularly a story on the popular computer news site, http://slashdot.org. Please take note – the story not completely correct. It references a different unpatched flaw in Wordpad that only affects Windows XP SP2. The IE7 vulnerability affects every Microsoft Operating system, including Windows XP SP3 and Windows Vista SP1.
There is presently no patch available. ITS will endeavour to block sites that are known to be hosting malicious code using Murdoch’s proxy server.
IT Security recommends users increase their vigilance when browsing the internet using IE7. Users may wish to consider using an alternate browser, such as Mozilla Firefox. Alternate browser should only be used if they are up-to-date and fully patched. The current version of Firefox is 3.0.4. Firefox’s version can be checked by opening the “Help” menu, and choosing the “About” option.
This morning, Microsoft released its December 2008 security bulletin disclosing six vulnerabilities of "critical" severity that permit "Remote Code Execution”. This means the vulnerability can be exploited remotely. A severity rating of "critical" means "a vulnerability whose exploitation could allow the propagation of an Internet worm without user action."
In addition, Microsoft announced two vulnerabilities of “important” severity. A severity rating of important means “a vulnerability whose exploitation could result in the confidentiality, integrity or availability of users’ data”.
All versions of Microsoft desktop and server operating systems (including Windows Vista and Windows Server 2008) are vulnerable, and should be patched ASAP.
All versions of Microsoft Office are also vulnerable to exploitation of the critical nature and should be patched immediately.
All systems with Microsoft Visual Basic 6.0, Visual Studio .NET 2002 or Visual Studio .NET 2003 installed are also vulnerable to remote exploitation. All installations of these programs should be patched immediately.
All of these vulnerabilities are applicable to the Murdoch environment, and can lead to total system compromise.
More information is available here - http://www.microsoft.com/technet/security/bulletin/ms08-dec.mspx