Hackers are exploiting the just-disclosed unpatched bug in Internet Explorer (IE) to launch drive-by attacks from malicious Web sites, security researchers said today.
"This attack appears to be rather targeted at the moment, but as with other unpatched vulnerabilities in the past, this has the potential to explode now that the word is getting out," said Craig Schmugar, a threat researcher at McAfee, in a blog post today.
Attacks are launched from Web sites in a classic drive-by fashion, said Schmugar and others. "Visiting the page is enough to get infected," Schmugar said.
Symantec also confirmed that it has spotted in-the-wild attacks exploiting the critical vulnerability in IE6 and IE7 that Microsoft acknowledged yesterday. "We're still seeing just limited attacks," said Ben Greenbaum, a senior research manager with Symantec's security response team. "The exploit is carried out simply by visiting a Web page hosting the vulnerability," he continued. "When the browser opens the page, the exploit causes the user's computer to download and execute another piece of malware."
Most of the malware downloaded and installed on the victimized PC consists of backdoors that let hackers install and run even more attack code. Among the malware is a .dll that's injected into IE to provide additional remote access to the machine, Schmugar said.
"It started out as limited and targeted, but now, with the drive-by attacks, it's no longer only a targeted attack," said Schmugar in an interview today.
Tuesday, Microsoft warned users of IE6 and IE7 that attackers were using an unpatched vulnerability in their browsers, but as is its practice, did not publish technical details of the bug.
Nor did Microsoft spell out a patching timetable, or promise that it would issue a fix before the next scheduled Patch Tuesday on April 13. Instead, it recommended that users modify access to the "iepeers.dll," disable scripting, and/or enable DEP (data execution prevention).
According to Vupen Security , the bug is a "user-after-free" memory error in how iepeers.dll handles certain data. "User-after-free" refers to an attempt to reuse memory space after it has been freed, said Andrew Storms, director of security operations at nCircle Network Security, in an instant message interview.
Neither Symantec nor McAfee have yet found evidence that the attack code has been widely distributed via hacker forums or posted more prominently on the Internet. When that happens, Schmugar said he expects attacks to quickly increase.
Microsoft may be forced to react with an emergency update if that happens, Greenbaum said. "It's possible Microsoft may consider an out-of-band patch for this issue," he said.