(Page 2 of 2)
Advice for IT Admins
Websense said in its security blog, "While the exploit appears to affect all versions of IE, at the moment, attacks seem to only be targeting users of IE8 and IE9 who are running Windows 7 and XP operating systems."
Websense said it strongly encouraged IT administrators to install the Microsoft Fix it patch while waiting for a formal patch from Microsoft.
Microsoft first issued its security advisory on September 17, telling its customers that under investigation was a "vulnerability in all supported versions of Internet Explorer. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability in Internet Explorer 8 and Internet Explorer 9." Microsoft said that its Fix it solution prevents the exploitation of this issue.
The vulnerability, said the Redmond tech giant, is a remote code execution vulnerability that exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated.
"The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer," said Microsoft. "An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site."
Microsoft said its action plans may include providing a solution through its monthly security update release process, "or an out-of-cycle security update, depending on customer needs."
Posted: 2013-10-22 @ 5:32am PT
Nancy-- Cyberthreats for users of Android phones and mobile devices also on the upswing. Check out a company/product called SnoopWall that just announced its public beta of "countersurveillance" software at the DEMO conference last week: www.snoopwall.com. Thanks