Page last updated at 01:11 GMT, Thursday, 18 December 2008

Microsoft issues patch to fix IE

Microsoft Internet Explorer logo, file Pic from 2004
Internet Explorer is used by the majority of computer users

Microsoft has issued a security patch to fix a critical vulnerability in its Internet Explorer browser which it said has attacked over 2m Windows users.

The flaw is believed to have already infected as many as 10,000 websites.

The "zero day" exploit let criminals take over victims' computers by steering them to infected websites.

Microsoft's Christopher Budd said the software giant "encourages all IE customers to test and deploy this update as soon as possible".

He also said the threat led Microsoft to mobilise security engineering teams worldwide to deliver a software cure "in the unprecedented time of eight days".

Change IE security settings to high (Look under Tools/Internet Options)
Switch to a Windows user account with limited rights to change a PC's settings
With IE7 or 8 on Vista turn on Protected Mode
Ensure your PC is updated
Keep anti-virus and anti-spyware software up to date
The company's security response team said the patch consists of more than 300 distinct updates for more than half-a-dozen versions of IE in around 50 languages.

"Even with that, the release Emergency Response process isn't over," said Security Response Alliance director Mike Reavey.

"There is additional support to customers and additional refinement of our product development efforts."

Microsoft stressed that the flaw was proven to exist only in IE 7 on all applicable versions of Windows, but that IE 6 and the "beta" release of IE 8 were "potentially vulnerable".

Users who have automatic updates turned on will receive the patch over the next 24 hours while others can access it via a download.


The AZN Trojan has been making the rounds since the beginning of December but became public knowledge in the last week . Unlike other exploits, users only have to visit a malicious site with Trojans or other malware in order to become contaminated.

Microsoft developed a patch for the "Zero day" flaw in record time

Once an infected web page is opened, malicious downloaders are installed on the computer designed to record keystrokes and steal passwords, credit card details and other financial information.

The sites affected are mostly Chinese and have been serving up programmes to steal passwords for computer games which can then be sold for cash on the black market.

Internet Explorer is the world's most widely used web browser with nearly three quarters of the market share.

Microsoft estimated that one in every 500 Windows users had been exposed to sites that tried to exploit the flaw and the number of victims was increasing at a rate of 50% daily.

Researchers at the software security firm Trend Micro said attacks were spreading "like wildfire".

"This vulnerability is being actively exploited by cyber-criminals and getting worse every day," said the company's advanced threat researcher Paul Ferguson.

Microsoft labelled the bug as "critical," the most serious threat ranking in its four-step scoring programme.

Firefox update

The update is something of an unusual move for Microsoft and underscores the seriousness of the zero day flaw.

The company rarely issues security fixes for its software outside of its regular monthly patch updates.

Firefox logo, Mozilla
Firefox will soon end its support of earlier versions of its popular browser

Meanwhile Mozilla has released a scheduled update for its open source Firefox web browsers for at least 10 different vulnerabilities.

The bugs in the browser could have been "used to run attacker code and install software, requiring no user interaction beyond normal browsing," said Mozilla.

It is also reissuing calls for users to upgrade from Firefox 2.0 to Firefox 3.0 as soon as possible and said it is "not planning any further security and stability updates for Firefox 2".

This means Mozilla will no longer support the Firefox 2 browser against future online scams and attacks.

Print Sponsor

Microsoft releases fix for IE
17 Dec 08 |  Technology
Internet Explorer security alert
16 Dec 08 |  Technology
Microsoft launches iPhone program
16 Dec 08 |  Technology
Malicious programs hit new high
08 Feb 08 |  Technology
Online risk due to browser flaws
08 Jul 08 |  Technology
Microsoft gives start-ups leg up
05 Nov 08 |  Technology
Security scares spark browser fix
16 Feb 05 |  Technology
Malware 'hijacks Windows Updates'
16 May 07 |  Technology
The original Microsoft 'family'
26 Jun 08 |  Business

The BBC is not responsible for the content of external internet sites

Has China's housing bubble burst?
How the world's oldest clove tree defied an empire
Why Royal Ballet principal Sergei Polunin quit


Americas Africa Europe Middle East South Asia Asia Pacific