Latest Internet Explorer Bug a Massive Risk

Microsoft has issued an emergency patch for Internet Explorer. In the most extreme circumstances, a user simply visiting a website could give a hacker complete remote control of a computer.

Between Chrome's dominance and Edge becoming the default on new Windows machines, Internet Explorer is far from popular and is now used on around 8 percent of desktop computers. However, that still means around a hundred million machines could be affected by this bug. (Source: bbc.co.uk)

It's a sign of how serious the problem is that Microsoft has issued an emergency patch, or as it calls it, an out-of-cycle update. The bug affects versions 9 to 11 of Internet Explorer. It's described as a "Scripting Engine Memory Corruption Vulnerability."

Remote Access a Huge Risk

In simple terms, that means the process Internet Explorer uses to turn a website's code into the page shown on screen isn't accessing the computer's memory in the correct way. That could mean a hacker could gain access to the rest of the machine.

To make things worse, the bug doesn't rely on the user taking any action other than visiting a compromised webpage - for example, by following a bogus link.

Once triggered, the bug gives hackers complete remote access to the computer on the same basis as the current user. That would be particularly dangerous if the user was logged in to Windows with an administrator account (as most do).

Bug Already Exploited

Microsoft notes that an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To makes things worse, Microsoft says that although the bug wasn't publicly disclosed before it released the update that fixes it, hackers are already actively exploiting it.

There are some workarounds that involve typing code into the Command Prompt. However, these are really only necessary for business networks where it takes time to roll out updates. Home users should instead concentrate on getting the update either through automatic updates or by visiting Microsoft's website. (Source: microsoft.com)

The bug was discovered and reported by Clement Lecigne of Google's Threat Analysis Group.

What's Your Opinion?

Are you surprised browsers still have such serious bugs? Do you still use Internet Explorer? Should Microsoft still offer security fixes even though it's no longer its main browser?