Hack contest sponsor confirms Internet Explorer 8 bug in final code

The final version of Microsoft Corp.'s Internet Explorer 8 (IE8) does contain the vulnerability used to hack a preview of the browser at last week's Pwn2Own, the contest's sponsor confirmed Friday.

But the exploit used by the computer science student to break the release candidate of IE8 -- and walk away with a Sony laptop and US$5,000 in cash -- won't work on the final version of IE8 as long as it's running in Windows Vista SP1 or Windows 7, said Terri Forslof, manager of security response at 3Com Corp.'s TippingPoint.

Questions had arisen about the exploitability of IE8 almost immediately after the Pwn2Own hack because Nils, the German student who gave only his first name, hacked IE8 Release Candidate 1 (RC1), while Microsoft released the final code less than 24 hours later.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine