VML Exploit Patched, Questions Remain VML Patch Released Ahead of October's Patch Tuesday Ed Sutherland
Microsoft has released a patch for a VML flaw being exploited.
The out-of-cycle security bulletin was released "in response to malicious and criminal attacks on computer users that were recently discovered," according to a spokesperson.
After Russian hackers used an underground toolkit last week to compromise host providers and 45 networks, security companies still see the onslaught continuing.
First revealed last week, the exploit uses a buffer overflow error in the Vector Markup Language (VML) library to execute remote code.
At its high point between Thursday and Saturday, the exploit took control of 45 networks, thousands of domains and potentially a half-million Web sites.
Each include malicious code, according to Ken Dunham, director of the rapid response team at VeriSign's iDefense.
Now Sunbelt Software, the company that announced the VML flaw in IE, said the Web attacks are morphing to e-mail phishing attempts.
The new attacks use an error in the DirectAnimation Path ActiveX control enabling hackers to plant malware and Trojans in systems visiting malicious Web sites.
The new attacks come disguised as e-mail alerting users they've received a Yahoo Greeting Card, according to Websense.
However, the site downloads an IE Browser Helper Object that redirects information entered in any form to a third-party.
Websense vice president of security research Dan Hubbard expects the next wave of attacks to concentrate on Web servers used by high-profile sites. Along with a patch, Hubbard suggests Outlook users disable the preview frame.
Dunham said he was tracking 3,000 Web sites still using the Russian Web-Attacker toolkit.
However, the security expert believes e-mail-based exploits are now likely, including phishing scams hoping to gain financial information from consumers.
Microsoft, unavailable for comment, said Friday in a blog post it was working on an update to address the new vulnerability, yet countered reports that attacks were widespread.
"Attacks remain limited," wrote Scott Deacon, Microsoft Security Response Center Operations Manager. Deacon said "there's been some confusion about that."
Microsoft said it was "working non-stop" on an update and was evaluating whether to issue an out-of-cycle update. The next scheduled update is set for Oct. 10 as part of the monthly "Patch Tuesday" event.
Last week, Microsoft updated a security advisory suggesting to users how to prevent the exploit.
However, it is likely the software maker will release an update as early as this week, Dunham said.
But with a continued threat and no assurance Microsoft will release a fix soon, Dunham advises consumers to install a third-party patch from the Zero-day Emergency Response Team, or ZERT.
While companies may want to rely on their own security guidelines and Microsoft, the reality for consumers is that they are forced to consider the unofficial patch, according to Dunham.
The security researcher has tested the patch and found it doesn't contain malicious code.
Although the recent scare was public, Dunham believes the next attacks will be silent and taught hackers a lesson.
