Microsoft has published Security Advisory (977981), confirming reports of a "zero day" vulnerability in Internet Explorer 6 SP1 and IE7. If you were thinking of upgrading to IE8, this would be a good time to do it. Microsoft says there have been no known attempts to exploit the security hole, but this could change at any time.
The vulnerability, published via the BugTraq mailing list, was described by Vupen Security:
This issue is caused due to a memory corruption error in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious web page.
Its suggested solution is: "Disable Active Scripting in the Internet and Local intranet security zones." Because so many sites use JavaScript, an alternative would be to change the security zone setting to High so that you get a prompt before scripts are run. You can also add trusted sites to the Trusted zone.
The vulnerability affects browsers running on both Windows XP and Vista, but it's potentially more dangerous on XP. Vista runs IE7 in Protected Mode where exploits can't do as much harm.
Microsoft also points out that: "This vulnerability is more difficult to exploit successfully if Data Execution Protection (DEP) is enabled for Internet Explorer." Microsoft has a one-click Fix It that enables users to turn DEP on, if their PC has the feature.
Presumably Microsoft will release a patch, but it remains to be seen whether it will make it in time for next month's Patch Tuesday on 8 December or release it as an out-of-cycle update once it has been tested.
Symantec noted: "The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future."
Some bad guys deploying a reliable version of exploit on a few prime sites would certainly get people's attention.
