New IE Flaws Might Allow Code Injection

On Monday, Jelmer Kuperus posted a message to the Full Disclosure mailing list to report the existence of new vulnerabilities in Internet Explorer, as well as exploits that take advantage of those flaws.

According to Kuperus, an unknown person tipped him to a Web page that installs adware onto unsuspecting users' system. Kuperus said the technique involved "serious handwork," meaning that the methods used by the person who developed the exploit are somewhat sophisticated and involve considerable knowledge of the Windows platform.

In his analysis of the exploit Kuperus discovered that the exploit uses a combination of Javascript, iframes, PHP, and timing techniques to gain access to the trusted Intranet Zone on a user's system. Kuperus said that the exploit also "uses several known vulnerabilities and two previously unknown vulnerabilities."

There is no patch available for at least one of the known vulnerabilities. The previously unknown vulnerabilities pertain to script-based URL location parameters as well as the ability to gain access to IE's trusted Intranet Zone.

In his analysis Kuperus also discovered the exploit uses script encoding techniques to obscure the actual code, which might help it bypass Web and virus filtering systems. Tools are available to reverse the script encoding, which help reveal the details of how the exploit works.

A fully patched IE is still vulnerable to the attack unless users disable scripting (particularly Javascript,) which can be done by manually adjusting the settings of the Internet Zone, or by setting the overall security level of IE to "High," which doesn't allow scripts to run.

Microsoft learned of the exploit, which is apparently being used by people to inject adware into people's computers. The company told News.com that they consider it criminal to use an exploit to run a program, apparently implying that even if the program itself is legal, they see the use of an exploit to launch it as criminal activity. The company has contacted the FBI regarding the matter.

Secunia released an advisory about the problems, which the company considers "extremely critical." As a result of the new-found exploit and its severity we might see Microsoft release at least one new IE patch well before its next scheduled security patch release date of July 15.

End of Article