A critical vulnerability is identified in Internet
Explorer versions 5+ and above. Security experts at
MicroWorld Technologies say a malicious code named
'Exploit.HTML.VML' is being actively exploited by
Pornographic and other shady websites to install Spyware
and Trojans into user computers without their knowledge.
The vulnerability is found in the implementation
of VML -Vector Markup Language- derived from XML and
used in delivering vector graphics with geometrical
shapes and mathematical equations, in Internet Explorer.
File formats such as SWF(Flash), PDF(Adobe Acrobat),
AI (Adobe Illustrator), EMF (Microsoft Enhanced Metafile)
are examples of vector graphics.
'Exploit.HTML.VML' pushes other malware into computers
by inducing a Stack Buffer Overflow, when a smartly
crafted page with VML containing a long "fill"
method inside a "rect" tag, is displayed
in IE. In a typical scenario, Internet Explorer is
seen crashing soon after the exploit is delivered.
Microsoft has confirmed that the vulnerability allows
the malware author to execute arbitrary code on the
attacked system while acknowledging that a successful
intruder can gain local user rights on victim's computer.
The corporation is working on a patch for the flaw
and if the situation warrants, would go for an earlier
release of it, before its monthly patching cycle scheduled
on October 10.
"This is a Drive-by Download Attack using a
Zero-day vulnerability, making it a definite case
of clear and present danger," says CEO of MicroWorld
Technologies, Govind Rammurthy. "Just by visiting
shady websites, community portals or photo exchange
sites where user posted content is hosted without
much supervision, you could well be inviting sly malware
right into your PC."
Mail Clients like Outlook Express that preview emails,
using IE rendering mechanism, is also at equal risk,
says Govind Rammurthy. Potential large scale attacks
via email using VML embedded HTML, can be launched
to invade user computers, where all you need is to
view the mail, to be ambushed.
MicroWorld Security analysts suggest following actions
to safeguard computers till the patch is out:
MicroWorld
MicroWorld (www.mwti.net
) is the developer of the world's first Real-Time
Anti-Virus and Content Security software eScan
for desktops and servers. Its communication security
software,
MailScan is the first comprehensive e-mail
scanner for your SMTP/POP3 Mail Server. MicroWorld
Winsock Layer (MWL) is the revolutionary technology
underlying these products, powering them to several
certifications and awards by some of the most prestigious
testing bodies, notable among them being Virus Bulletin,
Checkmark, TUCOWS, Red Hat Ready, and Novell Ready.
Combining their powerful scanner with MWL technology,
MicroWorld solutions provide a Real-Time Proactive
security for your systems. For network security of
enterprises, eConceal Firewall is the latest powerful
offering from MicroWorld.
To learn more, kindly visit http://www.mwti.net.
