A security hole that has been patched, but by Microsoft`s admission "not as well as it could have been", still exists in some Internet Explorer (IE) browsers and may already have silently infected local machines, warns local security company SecureData.
Microsoft SA technical support manager Jonathan Hatchuel argues that the vulnerability has been widely publicised, and denies the likelihood of widespread exploits. "The chances of it being widely exploited and our call centres not picking it up are a million to one. And if you adhere to the `three steps` of safe computing, this is immediately avoided," he says.
The hole, known as the "Object Data vulnerability", is present in code used by IE to process Web pages containing an element called the Object Data tag. When exploited, the vulnerability allows attackers to drop a malicious program on PCs. Infection may occur when opening e-mail or visiting a Web site set up by an attacker.
Microsoft issued a software patch, MS03-032, on 20 August, a cumulative patch for IE. "We continue to encourage customers to install this security update," Microsoft states when asked whether the patch was sufficient.
The company admits the patch failed to close the hole on Windows machines running IE Versions 5.01, 5.5 and 6.0, and says it is "now investigating public reports of new variations on one of the vulnerabilities originally addressed in MS03-032".
"Prioritisation of patches is done on customer demand and severity. We have not had an increase in customer queries," says Hatchuel. "In cases where patches are not sufficient, the whole process goes under the microscope. It takes longer and sometimes has high executive visibility associated with it, so re-patching may take longer." Hatchuel says the company is "committed to keeping customers` information safe and is aggressively investigating these reports".
Ignorance isn`t bliss
Martin Potgieter, senior technical advisor at SecureData, which distributes Trend Micro security products, similarly reports no known local exploits, but warns that the characteristics of the kinds of vandals that may exploit the vulnerability can allow them to operate undetected.
"The trouble with these programs, called vandals by IDC, is that you almost never know about their presence on your system until a file disappears. It sits in memory, executes without your knowledge and doesn`t have appreciable performance degradation to alert you.
"In short, it is difficult for SecureData to say whether anyone has been infected or how many people, but it is a serious vulnerability."
Hatchuel disagrees, saying vandals will in "99% of cases cause performance degradation or system instability".
Concluding that leading anti-virus brands will "have to start offering" the kind of functionality that alerts users of spyware and vandals on their machines, Potgieter says SecureData`s principal, Trend Micro, will offer this by year-end.
Microsoft adds: "We continue to recommend customers keep their Windows systems up to date using Windows Update and ensuring Auto Update is enabled. Specifically, we recommend customers apply the MS03-032 update, to help protect against the original vulnerability, as well as the other issues addressed by that security update. Upon completion of our investigation, we will take appropriate action to protect our customers."
Share
