Patch for zero-day flaw in Microsoft IE

A critical zero-day flaw in Internet Explorer was exploited as part of the attack on Google and other companies, according to both Microsoft and McAfee.
The flaw allows for a Web-based attack against IE 6 SP 1 on Windows 2000, along with IE 7 and 8 on XP, Server 2003, Vista, Server 2008, Windows 7 and Windows Server 2008 R2. According to Microsoft's security advisory, the company has only seen active attacks against IE 6 so far.
The invalid pointer reference flaw allows for remote code execution, according to Microsoft, which means that viewing a malicious Web site could allow an attacker to execute any command on a vulnerable computer. Typically that would mean installing a Trojan or other malicious software. According to the bulletin, IE's Protected Mode on Vista and later versions of Windows mitigates the threat, which could also be leveraged by a banner ad.
According to Microsoft, “An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

 Detailed Information available in Microsoft Security Bulletin MS10-002 (Published: January 21, 2010 and rated as Critical)

Posted in: google, internet, microsoft