Microsoft Adds Security Fix To IE 8

The fix addressed a security flaw brought to light by security researchers Alexander Sotirov and Mark Dowd during the August BlackHat USA conference in Las Vegas.

Specifically, the error allowed them to bypass the Windows Vista defense-in-depth security layers that combined Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) in attacks targeting the IE browser by using the .Net framework to exploit a memory corruption vulnerability within the iexplore.exe process and subsequently run arbitrary code.

Microsoft said that the latest release of IE 8 on Windows Vista includes a block for the .Net+ASLR bypass mechanism from malicious Web sites, which restores the ASLR and the DEP back to the browser. The updated IE8 includes a function that regulates the loading of the .Net MIME filter, preventing it from loading in the Internet and Restricted Sites Zones, and making it more challenging for attackers to launch malicious code after discovering security vulnerabilities.

Microsoft's latest mitigation on its Web browser might have remediated an exploit made public a few days prior when a little-known German hacker successfully exploited the IE8 ASLR-DEP flaw March 19 during the Pwn2Own hacker contest at the CanSecWest security conference.

However, despite the fact that hackers ripped IE8, a recent NSS Labs study claimed that the new IE8 browser outshines competitors in protection against Web-based malware attacks with a 69 percent catch rate -- surpassing competing browsers Apple Safari, Mozilla Firefox and Google Chrome.

"No browser is 100 percent secure, but we are hoping if we keep adding defenses, they will be harder and harder to exploit," said Microsoft Security Response Center engineer Jonathan Ness in a blog post. "We heard from security researchers and exploit writers at both CanSecWest last week and SOURCE Boston the week before that writing exploits for Windows Vista is 'very very hard' with all these mitigations to work around. We expect that blocking the .Net DEP+ASLR bypass will make it even harder."