anyweb Posted December 13, 2010 Report post Posted December 13, 2010 A new hole in Microsoft’s Internet Explorer browser has been identified. The flaw, reported by security firm Vupen, allows remote attackers to take complete control of a vulnerable system. The issue is caused by a use-after-free error within the mshtml.dll library when processing webpages featuring CSS that use “@import” rules. Attacks can exploit the flaw by executing arbitary code via a specially crafted web page. The vulnerability affects Internet Explorer 8 on Windows 7, Windows Vista SP2 and Windows XP SP3. Internet Explorer 6 and 7 are also affected on Windows XP SP3. The flaw is currently un-patched and example code is available. It’s unclear whether the vulnerability is being actively exploited in the wild. Microsoft announced last week that it’s planning a bumper Patch Tuesday on December 14. The software giant plans to patch a 0-day flaw in all supported versions of Internet Explorer. Researchers warned last week that they had successfully bypassed Protected Mode on both Internet Explorer 7 and 8. Microsoft responded to the findings by claiming that the bypass is not a vulnerability and that Protected Mode is not a full security boundary. WinRumors has reached out to Microsoft for clarification on the latest vulnerability. At the time of writing we have not yet received a response. via > http://www.winrumors.com/new-critical-un-patched-internet-explorer-css-vulnerability-discovered/#ixzz17zd3SH9U Share this post Link to post Share on other sites More sharing options...
