Update IE now or risk attacks

Just three canicule afterwards Microsoft patched 11 bugs in Internet Explorer (IE), hackers are base one of those vulnerabilities, a aegis aggregation said Friday.

Microsoft anchored the blemish Tuesday in an 11-patch amend for IE. That amend was allotment of a beyond Patch Tuesday roll-out that quashed 34 bugs in 16 abstracted aegis bulletins.

Most aegis experts had put the IE amend at the top of their antecedence lists, and apprenticed Windows users to arrange it as anon as possible.

Today, Symantec arise that CVE 2011-1255 -- its assigned ID in the Common Vulnerabilities and Exposures database -- is already actuality abused. WMV file to DVD

"So far, we accept alone apparent bound attacks demography advantage of this vulnerability and accept that the accomplishment is alone actuality agitated out in targeted attacks at present," said Joji Hamada, a chief researcher with Symantec's aegis acknowledgment team, in a column to a aggregation blog .

Hamada said that Symantec had begin an accomplishment on an apparently-compromised armpit that automatically downloads an encrypted awful book to the PC of any user browsing with an unpatched archetype of IE8.

The malware shows some bot traits, Hamada added. Once buried on a machine, it contacts a alien server and listens for commands from its hacker overlords.

Although the CVE 2011-1255 vulnerability affects IE6 and IE7 as able-bodied as IE8, Symantec has alone apparent alive exploits that ambition the latter.

IE9, the browser that Microsoft launched in mid-March, is not afflicted by the vulnerability, although it was additionally patched Tuesday to abode four altered bugs.

In the accompanying advising , Microsoft called the blemish as "critical," its most-serious blackmail level, for IE7 and IE8 on all Windows machines, and for IE6 active on Windows XP. For IE6 on Windows Server 2003 Microsoft rated the bug as "moderate."

Microsoft additionally assigned a "1" to the vulnerability in its exploitability index, acceptation the aggregation accepted a reliable accomplishment to arise aural 30 days. The attackers exhausted that by a cogent margin, putting their accomplishment into comedy aural three days.

Microsoft was fabricated acquainted of the blemish in backward January by VeriSign's iDefense Labs, which had bought the bug from an bearding researcher through its compensation program.

iDefense's own advising categorized the vulnerability as a "use-after-free" bug, a blazon of anamnesis administration blemish that can be exploited to inject advance code.

Users clumsy to administer Tuesday's IE amend can balk the attacks Symantec has spotted by disabling JavaScript.

To about-face off JavaScript, users should baddest the "Tools" card in IE, again bang "Internet Options," the "Security" tab and the "Internet" agreeable zone. Next, bang "Custom Level" and in the "Settings" box, bang "Disable" beneath "Active scripting." Bang "OK" in the accepted chat box.

Read added about aegis in Computerworld's Aegis Topic Center.