Kaizenlog

—————————————+
| Experts Say To Switch Browsers In Light of IE Vulnerability        |
|   from the here’s-my-number-if-the-place-burns-down dept.          |
|   posted by timothy on Tuesday December 16, @08:52 (Security)      |
|   http://it.slashdot.org/article.pl?sid=08/12/16/1319217 |
+——————————————————————–+

It appears that the [0]exploit in IE briefly mentioned a few days ago is
causing a serious reaction: [1]SteveAU writes “Microsoft has begun
flooding media outlets with information [2]advising users to switch to an
alternate browser while a serious security flaw is being patched. The
flaw, which affects all versions of Microsoft Internet Explorer, is
manifested via malware and [3]has infected over 6,000 sites thus far.
Microsoft states: ‘The vulnerability exists as an [4]invalid pointer
reference in the data-binding function of Internet Explorer. When data
binding is enabled (which is the default state), it is possible under
certain conditions for an object to be released without updating the
array length, leaving the potential to access the deleted object’s memory
space. This can cause Internet Explorer to exit unexpectedly, in a state
that is exploitable.’” According to the BBC report, though, Microsoft
itself is only asking that users be “vigilant while it investigated and
prepared an emergency patch”; it’s outside experts who say to dump IE (at
least for now).

Update: 12/16 21:11 GMT by [5]KD : Microsoft will issue an [6]emergency
critical update for IE tomorrow.

Discuss this story at:
http://it.slashdot.org/comments.pl?sid=08/12/16/1319217

Links:
0. http://it.slashdot.org/article.pl?sid=08/12/10/206216&tid=172
1. mailto:ohkie [Email address: ohkie #AT# hotmail.com - replace #AT# with @ ]
2. http://news.bbc.co.uk/2/hi/technology/7784908.stm
3. http://www.eweek.com/c/a/Security/Hackers-Compromise-Legit-Web-Sites-to-Target-Microsoft-IE-Flaw/
4. http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9123338
5. http://slashdot.org/~kdawson/
6. http://www.microsoft.com/technet/security/bulletin/ms08-dec.mspx