eEye Digital Security is advising customers to the existence of exploit code that targets a critical security vulnerability in Microsoft Internet Explorer. The exploit pertains to an unpatched vulnerability that has been released on various public mailing lists.

Microsoft has released a security alert on this issue that can be found here:
http://www.microsoft.com/technet/security/advisory/917077.mspx

This issue affects any Windows operating system running Internet Explorer versions 5.01 SP4 through 6.0 SP2. The vulnerability results from the method in which Internet Explorer handles HTML Objects. This flaw allows for remote code to be executed on the target system. If successfully exploited, an attacker will only have the rights of the currently logged on user. System Administrators should be careful to not use Administrator accounts for general system use.

Currently, there have been numerous reports of this vulnerability being used on various websites in attempts to install Spyware and remote control "bot" software for use in Distributed Denial of Service (DDoS) attacks.

The recommended action required to protect systems against this attack is to disable Active Scripting from within Internet Explorer.

Following are the steps required to disable Active Scripting:

• To disable Active Scripting within Internet Explorer locally, users should refer to the Microsoft Support Bulletin:
  http://support.microsoft.com/kb/q154036/
  
  
• To disable Active Scripting across an entire Active Directory/Domain using GPO, security administrators should reference the following Microsoft Bulletins:
  • Internet Explorer Administrator Kit
    
  • Group Policy Reference Guide

Protecting Your Systems

eEye Digital Security's Research Team has confirmed that eEye's Blink® host-based intrusion prevention solution protects from the exploitation of this Internet Explorer flaw without requiring invasive firewalling, or the presence of any patch. Current Blink customers should ensure that the Application Protection is enabled in their Blink policies.

Organizations that have not already deployed Blink and are interested in evaluating the technology can learn more on the eEye website:
http://www.eeye.com/html/products/blink/index.html


Downloading eEye's Temporary Patch

Additionally, eEye Digital Security's Research Team has released a patch for the vulnerability as a temporary measure for customers who have not yet installed Blink. This patch is not meant to replace the forthcoming Microsoft patch, rather it is intended as a temporary protection against this flaw. Organizations should only install this patch if they are not able to disable Active Scripting as a means of mitigation.

Organizations that choose to install this patch should take the steps required to uninstall it once the official Microsoft patch is released.

The patch can be found here:
http://www.eeye.com/html/research/tools/JScriptPatchSetup.exe

For support, bug reports, or feedback please email alerts@eeye.com