Microsoft is reported to have scrambled to produce a cumulative patch to plug various 'critical` security holes in Internet Explorer (IE).
This follows reports last week that a badly patched IE security hole could allow machines to be infected silently. Local Internet security company SecureData said last week that the hole, known as the "object data vulnerability", could allow attackers to drop a malicious program on PCs.
Infection could occur when opening e-mail or visiting a Web site set up by an attacker. Microsoft disputed this, saying the chance of its being exploited were "a million to one". However, the company conceded that the hole had not been patched as well as it could have been.
Microsoft issued an advisory late on Friday after security consultants warned that a QHosts-1 Trojan was sneaking into PCs via unpatched IE holes. Anti-virus company McAfee said attackers had used the Trojan to redirect browsers to different sites.
Microsoft said the most serious flaw occurred because IE does not properly determine an object type returned from a Web server in a pop-up window. It made it possible for an attacker to run arbitrary code on a user`s system.
Share
