IE Flaw Spawns Web Attacks, Another Third-Party Patch

Published: October 4, 2006

by Alex Woodie

The newly discovered "WebViewFolderIcon" flaw in Internet Explorer is being used to launch attacks and spread malware on the Internet, Microsoft warned in a security advisory last week. And for the second week in a row, the group of researchers calling themselves the Zeroday Emergency Response Team (ZERT) has released a patch that purportedly fixes the problem.

According to Microsoft Security Advisory 926043, exploit code is currently available on the Web for the newly found buffer overflow vulnerability in WebViewFolderIcon, which opens the door for attackers to install malware or take control of systems when users try to open a malformed ActiveX control in Windows 2000, Windows XP, and Windows Server 2003.

Malformed Web sites are the most likely form of distribution for vectors using this flaw, which is called "setSlice" by some security organizations. It has been estimated that 600 Web sites are infected or will soon be serving malformed ActiveX controls utilizing the WebViewFolderIcon. Windows Server 2003 users are not as susceptible to infection because ActiveX for IE is disabled by default, the software giant says.

Microsoft is working on a patch, and expects to have it ready by the October 10 "Patch Tuesday" event, which is less than a week away.

However, ZERT appears to have beat Microsoft at the patch game for the second week in a row. The group updated its ZProtector product to guard users against the new vulnerability; it can be downloaded at the group's Web site at zert.isotf.org .

Another third-party patch was issued by Determina, a security software company based in Redwood City, California. The company's free product "The Shield" will protect users against the exploit code on all versions of Windows, and won't interfere with the official Microsoft patch when it becomes available, the company says.

As is the case with all third-party patches, Microsoft doesn't sanction their use, and recommends that users hold tight until it can fully test its patch and release it with confidence.

RELATED STORIES

Microsoft Issues Out-of-Cycle Patch for VML Flaw

Microsoft Patches WMF Flaw Early, Issues Two Additional Patches