(1888PressRelease)
December 16, 2008 - With the default Internet Explorer 7 data binding settings in place, a memory corruption error could occur when processing specially-crafted XML content that can cause an affected browser to unexpectedly close in a vulnerable state or to execute arbitrary code.
This exploit is accomplished by a user visiting a malicious web page containing the bogus XML which is then used to remotely compromise the vulnerable application. A successful exploit could allow the attacker to gain the same user rights as the local user.
Users whose accounts are configured to operate with administrative user rights would be more affected than users who have fewer user rights on the system.
Exploitation of this vulnerability has been reported as being “in the wild,” with sample exploit code published on the Internet.
Attacks against the vulnerability are currently targeting Windows Internet Explorer 7 on the following Windows editions: XP Service Pack 2, XP Service Pack 3, Server 2003 Service Pack 1, Server 2003 Service Pack 2, Vista/Vista Service Pack 1, and Server 2008. According to the Microsoft advisory, other versions of Internet Explorer on other editions of Windows may also be vulnerable.
“Windows laptops, desktops, and servers running our lightweight StormShield Security Suite client are automatically protected against any zero-day attacks related to this vulnerability,” says Thomas Garnier, Senior Research Engineer at SkyRecon Systems. “By simply having the StormShield option, ‘Protection against overflow’ set to ‘Critical’ or ‘High’ level, our customers’ systems and data are automatically protected, even without a patch update. SkyRecon’s ongoing research and development allows its StormShield customers to continue to operate their business with confidence.”
StormShield Security Suite provides proactive protection for the system and the data delivered through a multi-layered, light-weight single endpoint protection platform, providing dynamic and risk-based policy control and enforcement for: anti-virus/anti-spyware, device control, content encryption, host-based intrusion prevention (HIPS), system firewall, application control, wireless security, and network access control (NAC). To learn more about the comprehensive protection and dynamic policy enforcement available in StormShield, be sure to register for an upcoming educational webinar at http://skyrecon.com/webinars.
• System Protection at http://skyrecon.com/system_protection
• Disk & File Encryption at http://skyrecon.com/encryption
• Data Protection at http://skyrecon.com/data_protection
• Access Control at http://skyrecon.com/access_control
• IT Compliance at http://skyrecon.com/it_compliance
• USB Security at http://skyrecon.com/usb-security
About SkyRecon Systems Inc.
Founded in 2003, SkyRecon Systems is a leading global provider of endpoint protection platforms. With its award-winning single-policy endpoint security solutions, organizations are able to ensure protection and enforce policy for the endpoint systems, applications, data and users upon which their business relies. The company is a contributing member of the SecureIT Alliance, has received the prestigious Red Herring 100 Award, and has been named "Entrepreneurial Security Company of the Year” by Frost & Sullivan. StormShield has again received 4 stars in the SC Magazine Endpoint Security Group Test, has been nominated as a finalist for the SC Awards magazine in the US Best Mobile Device Security Solution category and the 2008 TechWorld.com Awards in the Endpoint Security Product of the Year category, and was also recently selected as a top 10 vendor for the 2008 Computer Reseller News list of Emerging Tech Vendors You Need to Know.
More information about SkyRecon can be obtained by visiting www.skyrecon.com, attending an educational security webinar, or by calling +1 (877) 239-3057.
Press Contact:
Sean Martin, CISSP
smartin ( @ ) skyrecon dot com
(949) 878-0592
SkyRecon, the SkyRecon logo, StormShield, and TradeShield are registered trademarks of SkyRecon Systems Inc. All other product or service names are the property of their respective owners.
###
