Microsoft breaks patch cycle for surprise IE fix

 

Gallery

By Stuart Turton

Posted on 30 Mar 2010 at 08:17

A zero-day vulnerability in Internet Explorer has forced Microsoft to issue an out-of-cycle patch for the second time in three months.

The patch will plug a vulnerability that has been used to to launch drive-by attacks on people running Internet Explorer 6 and 7 for the last few weeks. The vulnerability requires users to visit a malicious website, at which point malware is automatically downloaded to their computer.

"We have been monitoring this issue and have determined an out-of-band release is needed to protect customers," said Microsoft in an advisory.

We have been monitoring this issue and have determined an out-of-band release is needed to protect customers

"Internet Explorer 8 is unaffected by the vulnerability addressed in the advisory and we continue to encourage all customers to upgrade to this version to benefit from the improved security protection it offers."

Windows 7 users are also unaffected by the vulnerability.

The out-of-cycle update follows an emergency patch for Internet Explorer in late January, which addressed eight vulnerabilities in the browser, including one that was used to attack the networks of Google and Adobe.

As with that update, the latest patch also brings a host of fixes addressing flaws in every version of Internet Explorer.

"The out-of-band security bulletin is a cumulative security update for Internet Explorer and will also contain fixes for privately reported vulnerabilities rated Critical on all versions of Internet Explorer that are not related to this attack," said Microsoft.