MS IE Javascript exploit for zero-day (0-day) vulnerability
An exploit for last weeks zero-day (0-day) javascript vulnerability in Microsoft’s Internet Explorer is in the wild. I saw this post from Sunbelt a couple nights ago go up and disappear, at the time I didn’t have long enough to read it… It’s back today and there are instructions for mitigating the risk. However, there is still no patch from Microsoft and no word on when to expect one. According to the Sunbelt post the exploit in the wild is being used for browser hijacking/spyware install stuff.
The Incidents.org handlers diary chimes in too musing on whether we’ll have an out of cycle patch, or if MS will wait until December 13th. MS has updated their security advisory, so Incidents is betting on an early/out of cycle fix. Hope that’s the case.
PC Pro also has an article on this today.
–update– 12/1/05–
The securityfix has it this morning along with connecting the dots to yesterday’s beta release of Microsoft’s antivirus software and promotion of the Windows Live Safety Center. The last time MS did antivirus, one of the big complaints was essentially lagging/sluggish response in the realm of updates (which for antivirus is critical). With the purchase of GeCad, they have a good antivirus structure, my main question will be if they can give the frequent updates it deserves. (With security patches now coming out only once a month, many times in spite of known vulnerabilities, I wonder…)
Anyway, Microsoft has an entry in their “Malicious software encyclopedia” for the worm installed by the “in the wild” exploit Trojan Downloader information.
The register has more on Windows OneCare Live beta. (OneCare is the name for Microsoft’s new antivirus package.)