Redmond promises IE8 patch is in the pipeline

Bug not so bad, Microsoft says, but if you won't upgrade we'll get around to it eventually


Microsoft has announced it is working on a patch for a zero day Internet Explorer 8 vulnerability first identified seven months ago.

Perhaps following a report by El Reg, Redmond said it will bake a patch for the flaw which allowed attackers to execute arbitrary code on computers running the older Internet Explorer version 8 through drive-by and phishing attacks.

Microsoft formerly told HP's Zero Day Initiative bug reporters users would need to harden their browsers after it examined the flaw in February, but would now issue a fix despite that it saw no impact to customers.

"Public disclosure was limited and does not currently represent risk to Internet Explorer users," a spokesperson said in a statement.

"We are not aware of any exploits resulting from a privately disclosed issue involving Internet Explorer 8 and have not identified any impact to our customers."

The patch would be issued "when it is ready", following thorough testing against a large number of applications and configurations.

Microsoft said users should upgrade to the latest Windows operating system and run Chrome or Firefox the latest version of Internet Explorer.

The Zero Day Initiative bug bounty clearing house dropped the vuln disclosure stating the use-after-flaw existed in Internet Explorers' handling of CMarkup objects.

"This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file," the disclosure read. ®

Similar topics


Other stories you might like

  • Boeing's Starliner capsule corroded due to high humidity levels, NASA explains, and the spaceship won't fly this year

    Meanwhile Elon's running orbital tourist trips and ISS crew missions

    Boeing’s CST-100 Starliner capsule, designed to carry astronauts to and from the International Space Station, will not fly until the first half of next year at the earliest, as the manufacturing giant continues to tackle an issue with the spacecraft’s valves.

    Things have not gone smoothly for Boeing. Its Starliner program has suffered numerous setbacks and delays. Just in August, a second unmanned test flight was scrapped after 13 of 24 valves in the spacecraft’s propulsion system jammed. In a briefing this week, Michelle Parker, chief engineer of space and launch at Boeing, shed more light on the errant components.

    Boeing believes the valves malfunctioned due to weather issues, we were told. Florida, home to NASA’s Kennedy Space Center where the Starliner is being assembled and tested, is known for hot, humid summers. Parker explained that the chemicals from the spacecraft’s oxidizer reacted with water condensation inside the valves to form nitric acid. The acidity corroded the valves, causing them to stick.

    Continue reading
  • Research finds consumer-grade IoT devices showing up... on corporate networks

    Considering the slack security of such kit, it's a perfect storm

    Increasing numbers of "non-business" Internet of Things devices are showing up inside corporate networks, Palo Alto Networks has warned, saying that smart lightbulbs and internet-connected pet feeders may not feature in organisations' threat models.

    According to Greg Day, VP and CSO EMEA of the US-based enterprise networking firm: "When you consider that the security controls in consumer IoT devices are minimal, so as not to increase the price, the lack of visibility coupled with increased remote working could lead to serious cybersecurity incidents."

    The company surveyed 1,900 IT decision-makers across 18 countries including the UK, US, Germany, the Netherlands and Australia, finding that just over three quarters (78 per cent) of them reported an increase in non-business IoT devices connected to their org's networks.

    Continue reading
  • Huawei appears to have quenched its thirst for power in favour of more efficient 5G

    Never mind the performance, man, think of the planet

    MBB Forum 2021 The "G" in 5G stands for Green, if the hours of keynotes at the Mobile Broadband Forum in Dubai are to be believed.

    Run by Huawei, the forum was a mixture of in-person event and talking heads over occasionally grainy video and kicked off with an admission by Ken Hu, rotating chairman of the Shenzhen-based electronics giant, that the adoption of 5G – with its promise of faster speeds, higher bandwidth and lower latency – was still quite low for some applications.

    Despite the dream five years ago, that the tech would link up everything, "we have not connected all things," Hu said.

    Continue reading

Biting the hand that feeds IT © 1998–2021