Fresh DirectShow Exploit In Internet Explorer Hits Windows Users
Thousands of websites have been hit by fast-moving exploit code that installs a cocktail of nasty malware on visitors’ computers by targeting a previously unknown vulnerability in some versions of Internet Explorer.
The compromised websites link to a series of servers that exploit a zero-day vulnerability in an IE component that processes media. The vulnerability affects those using the XP and 2003 versions of Windows, Microsoft warned in advisory 972890.
“An attacker who successfully exploited this vulnerability could gain the same user rights as the local user,” company security representatives wrote. “When using Internet Explorer, code execution is remote and may not require any user intervention.”
More than 1,000 websites have been compromised so they include links that redirect users to sites that exploit the vulnerability, according to this translation of an advisory from CSIS. The warning said Windows 2000 was also vulnerable to the attacks, contrary to Microsoft’s write-up, which explicitly said 2000 was not affected.
What isn’t in dispute is that IE 7 on Vista is not vulnerable, presumably because ActiveX objects are blocked by default, according to McAfee researchers Haowei Ren and Geok Meng Ong.
The compromised websites are largely located in China and are operated by local schools and community centers. They point to a series of links that ultimately redirect users to a server at 8oy4t.8 866.org, according to CSIS. The site includes a JPG file that exploits a variety of vulnerabilities, “including an unprecedented stack overflow in DirectShow MPEG2TuneRequest,” according to CSIS. Secunia rates the vulnerability “extremely critical,” the highest rating on its five-tier severity scale.
Other vulnerabilities that are exploited are known as XMLhttp.d, RealPlay.a, BBar, and the MS06-014, according to McAfee.
The new vulnerability in DirectShow is different than a DirectShow security bug Microsoft warned of in late May, a spokesman said.
Today’s Microsoft advisory offers a workaround users can take to safeguard against the vulnerability until a patch is released. It involves making changes to the Windows registry, a risky undertaking for those who aren’t sure what they’re doing. The easier fix is to stop using IE until there’s a fix, at least for those who don’t use apps that are dependent on the Microsoft browser.
Credit: The Register
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.