Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Microsoft is investigating the public report of a data-stealing vulnerability impacting Internet Explorer 8 (IE8).In a post to the Full Disclosure mailing list, Google security engineer Chris Evans described the issue as a "nasty vulnerability" that could be exploited to allow an arbitrary website to force a user to post a message on a social networking site such as Twitter. Attackers also could leverage the bug to hijack data from a victim's computer.Evans first revealed the flaw in December. In a blog post then, he said the bug could permit cross-domain theft because of a weakness in the way browsers handle CSS style sheets.Apple, Google, Mozilla and Opera reportedly were all once affected by the flaw but have since fixed it. Evans said he has tried to get Microsoft to issue a patch but thus far has been unsuccessful. He said the software giant may have known about the flaw since at least 2008, and it may affect earlier versions of IE.Microsoft has since tweeted that it was aware of the issue and planned to investigate.Jason Miller, data and security team manager at patch management firm Shavlik Technologies, said IT administrators should await word from Microsoft before taking any action."As Microsoft is investigating this issue, we fully expect a security advisory to be released with this issue soon," Miller said. "Until Microsoft fully researches the issue, there are no actions that need to be taken with this issue. It is very important to wait for vendor confirmation with zero-day exploits. Security researchers that publicly disclose vulnerabilities may not have all the information."See original article on scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.