A zero day flaw in Internet Explorer (IE) that impacts all versions of the browser is being actively exploited in the wild, Microsoft reports. Exploits seem to have focused on IE versions 8 and 9, according to Microsoft. But researchers at Websense have discovered that nearly 70 percent of Windows business users are susceptible to this IE zero-day exploit.
"We reviewed third-party telemetry feeds from real-time global internet requests to determine the initial scope. While the exploit appears to affect all versions of IE, at the moment attacks only seem to be targeting users of IE8 and IE9 who are running Windows 7 and XP operating systems," Websense's director of security research, Alex Watson, said in a statement.
According to the advisory, Microsoft said that IE installations running on Server 2003, 2008, and 2012 will mitigate the vulnerability due to its installation parameters. Experts have suggested that the scope of the problem is bad enough that Microsoft will likely release a fix outside of its usual patch schedule.
Unless Microsoft issues an out-of-band patch, the next round of security patches from Redmond are due October 8.
"This recently discovered Internet Explorer zero day vulnerability is bad. Users and administrators should take immediate action to mitigate the risk. Considering the timing, I personally expect to see an out of band patch from Microsoft," Rapid7's senior manager of security engineering, Ross Barrett, told CSO.
Read: Microsoft Security Advisory (2887505)
Source: PC World
"We reviewed third-party telemetry feeds from real-time global internet requests to determine the initial scope. While the exploit appears to affect all versions of IE, at the moment attacks only seem to be targeting users of IE8 and IE9 who are running Windows 7 and XP operating systems," Websense's director of security research, Alex Watson, said in a statement.
According to the advisory, Microsoft said that IE installations running on Server 2003, 2008, and 2012 will mitigate the vulnerability due to its installation parameters. Experts have suggested that the scope of the problem is bad enough that Microsoft will likely release a fix outside of its usual patch schedule.
Unless Microsoft issues an out-of-band patch, the next round of security patches from Redmond are due October 8.
"This recently discovered Internet Explorer zero day vulnerability is bad. Users and administrators should take immediate action to mitigate the risk. Considering the timing, I personally expect to see an out of band patch from Microsoft," Rapid7's senior manager of security engineering, Ross Barrett, told CSO.
Read: Microsoft Security Advisory (2887505)
Source: PC World