Microsoft IE7's zero-day hole

Microsoft warned of a new vulnerability in Internet Explorer 6 and 7 that has been targeted in attacks, and released fixes for eight holes in Windows and Office as part of Patch Tuesday.

The company issued Security Advisory 981374, which addresses a privately disclosed vulnerability. The hole could allow an attacker to take control of a machine if a user visited a malicious website, Microsoft said.

There are some features that could mitigate the effects of an attack. For instance, all supported versions of Microsoft Outlook, Microsoft Outlook Express and Windows Mail open HTML email messages in the Restricted sites zone by default, the company said.

"Protected Mode in Internet Explorer on Windows Vista and later Windows operating systems helps to limit the impact of the vulnerability as an attacker who successfully exploited this vulnerability would have very limited rights on the system," the advisory said. "By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the internet zone to High. This is a mitigating factor for websites that you have not added to the Internet Explorer Trusted sites zone."

The advisory also provides information on workarounds. Microsoft suggests that IE6 and IE7 users upgrade to IE8 immediately.

"For the second time in three months, Microsoft has also issued a warning about a new IE zero-day bug," said Andrew Storms, director of security operations for nCircle, referring to the IE hole that was exploited in the attacks on Google and other companies late last year and disclosed by Microsoft in January. "There's no doubt that this new bug will be fodder for the ongoing security discussion that is a key part of the browser wars."

In its Patch Tuesday preview on Thursday, Microsoft said it would issue two bulletins rated "important" on Tuesday to fix eight vulnerabilities in Windows and Microsoft Office products. Details are in the company's Security Bulletin for March.

The first bulletin for March, MS10-016, addresses a vulnerability in Windows Movie Maker that could be exploited by getting a user to open a maliciously crafted Movie Maker project file.

"Both Windows XP and Windows Vista ship with affected versions (2.1 and 6.0 respectively). Version 2.6 is also vulnerable and can be freely downloaded and installed from the web," Jerry Bryant, senior security communications manager lead at Microsoft, wrote in a blog post on the Microsoft Security Response Center. "Customers who install 2.6 on any supported platform, including Windows 7, will be offered the update."

The vulnerability also affects Microsoft Producer 2003, a free download with limited distribution. "At this time, we are not offering an update for Producer 2003," the blog post said. "While we continue to investigate Producer 2003, we recommend that customers either uninstall the application or apply an available Microsoft Fix it to disassociate the project file type from the application to add an extra layer of security."

The second bulletin, MS10-017, affects all currently supported versions of Microsoft Office Excel, as well as Office 2004 and Office 2008 for Mac, the Open XML File Format Converter for Mac, supported versions of Excel viewer and SharePoint 2007. A successful attack exploiting the hole would require a user to open a maliciously crafted file.

Meanwhile, the Malicious Software Removal Tool was updated to include Win32/Helpud, a trojan that steals log-in information for popular online games.

Microsoft also re-released MS09-033, a bulletin for a hole in Microsoft Virtual PC and Microsoft Virtual Server, to add Microsoft Virtual Server 2005 to the list of affected software.

The software giant said it is continuing to monitor threats in connection with Security Advisory 981169 related to a hole in VBScript affecting older Windows systems that Microsoft disclosed publicly on 1 March.

Although proof-of-concept code exploiting the hole has been released publicly, Microsoft said it was not aware of any active attacks. Customers using Windows 2000-, XP- and Server 2003-based systems are advised to apply the workarounds. Customers running Windows 7, Windows Server 2008, Windows Server 2008 R2 and Windows Vista are not affected.

Via CNET.com