Internet Explorer Vulnerability Poses Threat Of Remote Code Execution
Internet Explorer Vulnerability Poses Threat Of Remote Code Execution
Written by Kay Ewbank   
Monday, 28 April 2014

A flaw in all current versions of Internet Explorer, due to legacy ActiveX support,  that is currently being targeted has the potential for an attacker to take control of your computer. 

The vulnerability affects Internet Explorer 6, 7, 8, 9, 10 and 11, and concerns the way Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated.




Microsoft has issued a security advisory that explains that the vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. Specifically an attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

Although Microsoft is working on one, there’s no software update at the moment. Meanwhile it suggests that users set Internet and Local intranet security zone settings in Internet Explorer to "High" to block ActiveX Controls and Active Scripting in these zones. The company points out that in all cases an attacker would have to convince users to visit a website designed to take advantage of the vulnerability.

ActiveX is a technology that is only supported by IE because it is a Microsoft only invention. It is away of allowing COM components to be embedded in the browser. Despite ActiveX being superseded by .NET and more general Web standards a surprising number of web sites and even hardware like web cams still make use of ActiveX components making IE the only browser that will work with them. Hence the discovery of a bug in the way IE handles object deallocation will be a big problem for some users.

Much more of a problem is the fact that the need to continue to support ActiveX in new version of IE means that the entire family is vulnerable to the problem - and the code is unlikely to have been updated since the days of IE 6.

While a patch will be released for current versions of Windows, anyone using Windows XP will not get an update due to support for XP having ended on April 8.

Browsers other than IE such as Chrome or Firefox aren’t vulnerable to the attack,simply because they don't support ActiveX,  so would represent a safe alternative, not only for XP diehards but also for any Windows user - unless of course you need ActiveX support. 


Facebook's Redex Makes Android More Efficient

Or does it? Facebook developers have just described a project that aims to optimize Java byte code. The post is impressive. but it gives the impression that it is breaking new ground - it isn't.

Android Studio 1.4 Goes Vector

Decimal point upgrades are generally not game changing, but there is a new feature in Android Studio 1.4 - vector assets. What's this all about? 

More News


blog comments powered by Disqus


Last Updated ( Monday, 28 April 2014 )

RSS feed of news items only
I Programmer News
Copyright © 2015 All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.