Microsoft IE Vulnerability to be patched September 21, 2012!

Posted on 09/21/12 in Internet Fun, News, Small Business, Support, No Comments

Be sure to do your Windows Update, Java update, and security software updates over the next few days. Then be sure to do a through security scan of your system(s).


Tom’s Hardware > News > Solutions > Software > Microsoft Releases Out-of-Band Patch For IE Vulnerability

Microsoft Releases Out-of-Band Patch For IE Vulnerability

6:00 AM – September 21, 2012 by Wolfgang Gruener - source: Microsoft

Microsoft has reacted quickly to a recently emerged zero-day exploit that affects IE 6, 7, 8, and 9. The patch will be made available to IE users on Friday and users are advised to update their IE right away.

Released as a MSI package, the patch is described as a workaround that leverages the Windows application compatibility toolkit to make a small change to MSHTML.DLL in memory every time the DLL is loaded by Internet Explorer. Microsoft previously recommended IE users to take this step manually, while the patch automates the task. Microsoft provides an installation guide for the workaround as well as information to uninstall the patch again.

Microsoft stressed that the workaround is only effective if all recent security updates for IE have been installed as well.

The company confirmed existing attacks that exploit the vulnerability. However, Microsoft said that “only 32-bit versions of Internet Explorer” are targeted and attacks “rely on third-party browser plugins to either perform efficient heap-spray in memory and/or to bypass the built-in mitigations of Windows Vista and 7 such as DEP and ASLR.” However, users can further reduce the risk of a successful attack by updating theirJava version from Java 6 to 7.