Security-X
Forum Security-X => News => Discussion démarrée par: SX-News le septembre 21, 2012, 19:35:22
-
Internet Explorer zero-day vulnerability
Description : A new vulnerability found in Microsoft Internet Explorer affects Internet Explorer versions 6, 7, 8, and 9. The vulnerability allows attackers to execute code on a machine by just having the user visit a malicious website. This can happen, for example, when the user is tricked into clicking a link in an email or via compromised legitimate websites.
<img alt="" border="0" src="http://community.websense.com/resized-image.ashx/__size/550x0/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/8764.ie_5F00_0day.png" /> (http://"http://community.websense.com/cfs-file.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/8764.ie_5F00_0day.png")
The vulnerability itself lies in the way that Internet Explorer accesses an object that has been deleted or not properly allocated. This vulnerability has now been listed by Metasploit, which means it is available publicly, and we anticipate that we'll soon see this Internet Explorer vulnerability used in broader attacks. More information about the vulnerability can be found in this Microsoft Advisory (http://"http://technet.microsoft.com/en-us/security/advisory/2757760" target="_blank").
We have released updates to the real-time analytics of ACE™, our Advanced Classification Engine (http://"http://www.websense.com/content/websense-advanced-classification-engine.aspx?cmpid=slbl" target="_blank"), which means that Websense customers are protected. As a member of the Microsoft Active Protection Program (MAPP (http://"http://www.microsoft.com/security/msrc/collaboration/mapp.aspx" target="_blank")), we are also working with Microsoft to monitor this situation.<div style="clear: both;"]</div>
Lien : http://community.websense.com/blogs/securitylabs/archive/2012/09/17/internet-explorer-zero-day-vulnerability.aspx