As it promised yesterday, Microsoft Corp. today issued an emergency patch to plug a critical hole in Internet Explorer(IE) that attackers have been increasingly exploiting from hacked Web sites.
The patch, described in Microsoft’s security bulletin security bulletin MS08-078, fixes a flaw in the data-binding function of all available versions of the popular browser, including IE5.01, IE6, IE7 and IE8 Beta 2.
Microsoft labeled the bug as “critical,” the most serious threat ranking in its four-step scoring system. Today’s update was the second out-of-cycle patch from Microsoft in the past two months.
Researchers unanimously praised Microsoft for putting out the patch as quickly as it did.
“This was clearly an all-hands-on deck effort,” said Eric Schultze, chief technology officer at Shavlik Technologies LLC. “The out-of-band process worked exactly as intended in this case.”
Andrew Storms, the director of security operations at nCircle Network Security Inc., seconded Schultze. “This was a classic case of what we would like to happen. Microsoft acknowledged the fault, issued work-arounds, gave us advance notice that it would patch and then released the patch,” he said.
Wolfgang Kandek, chief technology officer at Qualys Inc., also applauded Microsoft. “Considering the way that Microsoft is set up, I thought this was pretty quick,” he said.
Microsoft first acknowledged the vulnerability a week ago today, one day after it unleashed its biggest set of security updates in more than five years.
At the time, it said that only the newest production version of the browser, IE7, was at risk, but the company quickly changed its tune when additional research revealed that all versions contained the bug.
According to both Microsoft and numerous security firms, attacks have been mounting, particularly since last weekend, when hackers began hijacking legitimate Web sites and launching exploits against unwary visitors. In fact, Microsoft said it monitored a “huge increase” in attacks last Saturday.
Reports of the vulnerability and publicly-available exploit code first surfaced Dec. 9, although at least one researcher said he had found evidence of attacks starting three days before.
In any case, Microsoft was quick to respond, said researchers. “They’re getting better in terms of their speed and agility to respond,” said Storms. “Actually, today was very anticlimactic. Probably the biggest part of this was all the build-up.”
The analysts agreed that Microsoft didn’t act in a vacuum, but pushed the patch process because of the attack situation. “By late last week, Microsoft was aware that this issue was starting to infect users’ systems at a faster rate than they’ve seen with past zero-day exploits,” said Schultze in a follow-up e-mail today.
“They fixed this so quickly because [the exploit] became public,” added Storms.
The drumbeat of news, and Microsoft’s own warnings that attacks were on the rise, prompted some to recommend that IE users abandon the browser for an alternative, such as Mozilla’s Firefox, Opera Software’s Opera or Google’s Chrome.
“That advice just wasn’t merited,” argued Schultze, “particularly with the patch coming.”
Kandek urged people to apply the patch immediately and said that enterprises should be able to deploy the fix without much testing.
“You should be able to roll it out with your normal patch process,” he said. “I think any fallout should be minor. Fixes for Word, PowerPoint and especially IE, you should be able to [deploy] quickly without much testing necessary.”
The patch is available for users of Windows 2000, XP, Vista, Server 2003 and Server 2008 and can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.
