Microsoft warns over zero-day Internet Explorer bug

Microsoft warns over zero-day Internet Explorer bug


Microsoft warned on Wednesday of a new zero-day vulnerability in Internet Explorer.

The flaw creates a means for hackers to inject malware onto vulnerable systems, providing surfers are first tricked into visiting booby-trapped websites. As such the flaw poses a severe drive-by download risk.

All established version of IE ( from 6 to 8 ) are affected. It’s unclear whether or not the IE 9 beta is similarly vulnerable. The flaw reportedly involves the handling of Cascading Style Sheets by Microsoft’s browser software. The bug first came to light on the full disclosure mailing list earlier this month.


A module exploiting the bug – which is noteworthy because it defeats Data Execution Prevention (DEP) and Address Space Layout Randomisation (ASLR) security defences in Microsoft products – has been added by the Metasploit project.

No patch is available but Redmond has published an advisory explaining how to mitigate against possible attack.

A more detailed discussion of the flaw can be found in a blog post by Paul Duckin of Sophos here. ®

Source :

Note : You also can read my tutorial about Internet Explorer v6, v7, v8 Memory Corruption Zeroday Exploit Using Metasploit(CVE-2010-3962)

Share this article if you found it was useful:

Blogger at

See all posts by || Visit Website :