IE Flaw Exploit In Hacker Kit 'Raises the Stakes'

Posted by Soulskill on Monday November 8, 2010 @10:09AM from the calling-a-bluff dept.

CWmike writes "Roger Thompson, chief research officer of AVG Technologies, said Sunday that an exploit for the newest IE flaw had been added to the Eleonore crimeware attack kit. 'This raises the stakes considerably, as it means that anyone can buy the kit for a few hundred bucks, and they have a working zero-day,' Thompson said on his company's blog. Microsoft has promised to patch the vulnerability, but last week said the threat didn't warrant an 'out-of-band' update. Microsoft will deliver three security updates Nov. 9, but won't fix the IE bug then."

1 of 96 comments (clear)

Min score:

Reason:

Sort:

Re:Bug is really for Windows XP by NetNed · 2010-11-08 10:27 · Score: 5, Informative

Ah no it is a IE6 and potentially a IE7 problem if you do not have DEP turned on. It is on by default on IE8, but not in 7 and doesn't exist in 6. Really has nothing to do with the UAC controls in place on Vista or Windows 7 since DEP is the front line defense against these attacks and works to stop the attacks before any registry altering is even possible.