December 23, 2010, 9:04 AM — Microsoft late Wednesday confirmed that all versions of Internet Explorer (IE) contain a critical vulnerability that attackers can exploit by persuading users to visit a rigged Web site.
Although the company said it would patch the problem, it is not planning to rush out an emergency update.
"The issue does not currently meet the criteria for an out-of-band release," said Carlene Chmaj, a spokeswoman for the Microsoft Security Response Center (MSRC), in an entry on the center's blog. "However, we are monitoring the threat landscape very closely and if the situation changes, we will post updates."
Chmaj also downplayed the threat posed by the bug. "Currently the impact of this vulnerability is limited and we are not aware of any affected customers or active attacks targeting customers," she said.
The vulnerability in IE6, IE7 and IE8 surfaced several weeks ago when French security firm Vupen disclosed a flaw in IE's HTML engine. Tuesday, researchers posted a video demonstration of an attack, and added a reliable exploit to the Metasploit penetration toolkit.
That exploit used a technique revealed earlier this year by McAfee researchers that defeats a pair of important Windows defensive technologies -- ASLR (address space layout randomization) and DEP (data execution prevention) -- designed to stymie most attacks.
The appearance of the Metasploit attack code may have been what prompted Microsoft to take action, as the company's more technical "Security Research & Defense" blog highlighted the Metasploit module.
In that blog, Microsoft security software engineer J. Serna also confirmed that IE's "mscorie.dll" file does not always automatically enable ASLR, a technology that randomly allocates executable memory to make it difficult for hackers to run their code.
Until a patch is ready, Microsoft urged users to use the Enhanced Mitigation Experience Toolkit (EMET) utility to bolster IE's defenses. The company provided instructions on how to configure EMET to block attacks in the accompanying security advisory .
EMET is a tool designed for advanced users, primarily enterprise IT pros, and manually enables ASLR and DEP for specific applications. It's often used to reinforce older programs.