01:52 PM
Core System Testing: How to Achieve Success
Oct 06, 2016
Property and Casualty Insurers have been investing in modernizing their core systems to provide fl ...Read More>>

Microsoft Downplays Significance Of IE Bug

Microsoft says only a few applications use the component vulnerable to a bug exposed last week.

Microsoft on Monday continued to downplay the potential impact of last week's "zero-day" vulnerability in Internet Explorer, now by stressing the limited number of applications which use the flawed component.

According to a revamped security advisory on the Microsoft Web site, the affected COM object, Msdds.dll, is not added to a Windows system by default. It's actually only present when Microsoft Visual Studio 2002 and some versions of Microsoft Office applications have been installed.

"Customers who use the initial release of Microsoft Visual Studio 2002 are at risk from this vulnerability and are encouraged to apply Microsoft Visual Studio 2002 Service Pack 1," Microsoft stated in the updated advisory.

Other at-risk installations are Microsoft Office XP SP3 and Microsoft Access 2002 SP3.

Because Visual Studio 2002 is a development tool, it's unlikely run-of-the-mill business or home users will be vulnerable to an exploit of this Internet Explorer vulnerability. The bug in IE is due to a memory error caused when the browser calls on the Msdds.dll file as an ActiveX control. A successful exploit, which would be posted on a malicious Web site, could give the attacker complete control of the PC without any user interaction.

The revised advisory also offers a number of workarounds that users and enterprises can apply, including setting IE security to "high" and disabling the Msdds.dll file from running in IE.

Last week, the SANS Internet Storm Center posted a small free-of-charge utility that automatically "patched" the flaw by modifying the Windows registry.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.