Microsoft Expands Zero-Day IE Warning

Did Microsoft miss a vulnerability in its latest Internet Explorer (IE) patch roundup -- or several?

Late Thursday, Microsoft updated its advisory on a zero-day vulnerability affecting its IE 7 Web browser. The updated advisory now indicates that older and newer versions of IE are also at risk from the XML zero-day (define) flaw.

As a result, the company is now warning that IE 5.01 Service Pack 4, IE 6 and IE 6 SP1, and Windows Internet Explorer 8 Beta 2 are all potentially at risk.

The flaw stems from an issue in how Internet Explorer parses XML. Microsoft reported the vulnerability a day after issuing its December Patch Tuesday update, which contained four different fixes for versions of IE.

As of late Thursday, there were no reported public sightings of the XML flaw in action on browsers other than IE 7, according to the security watchdogs at SANS Internet Storm Center (ISC).

"I don't want to start a panic," ISC handler Kevin Liston wrote in a post on ISC's site. "We have not received any reports of attacks affecting these versions (yet.)"

Signs point to new attacks

The same, however, can't be said for attacks based on IE7. Johannes Ullrich, another handler at ISC, reported on the group's site an SQL (define) injection attack spreading by using the browser's vulnerability.

Microsoft itself is reporting attacks in the wild and is providing some direction as to which countries have been affected the most so far. According to Microsoft's Microsoft Malware Protection Center blog, as of late Thursday, 64 percent of reported infections were coming from the U.S., 7 percent from China, 7 percent from Canada and 5 percent from Japan.

"The exploit sites we've seen so far drop a wide variety of malware," Microsoft said. "Most commonly password stealers, like new variants of game password stealers like Win32/OnLineGames, and Win32/Lolyda; keyloggers like Win32/Lmir; trojan horse applications like Win32/Helpudalong with some previously unseen malware, which we generically detect as Win32/SystemHijack."

This article was first published on InternetNews.com. To read the full article, click here.