The Latest SonicWall News
Product and Solution Information, Press Releases, Announcements
| SonicWALL Internet Threat Prevention Has Customers Covered Against IE Vulnerability | |
| Posted: Mon Jul 13, 2009 11:08:00 AM | |
|
SonicWALL, Inc. , a leading secure network infrastructure company, confirmed today that users of its Gateway AV/IPS technology are automatically protected against the recently discovered vulnerability within Microsoft's Internet Explorer (IE) browser. SonicWALL's vulnerability and malware research team yesterday deployed Intrusion Prevention (IPS) signatures that address the flaws in Window's IE, without the customer needing to manually update the service. As a result, customers with a current subscription to SonicWALL's gateway threat prevention services are automatically protected against the Microsoft Windows Internet Explorer vulnerability. "While Microsoft is working to develop a patch update for this, there is a significant window of opportunity for hackers to exploit the vulnerability and infect PC's without the user's knowledge," commented Boris Yanovsky, Vice President of SonicWALL's vulnerability research team. "We expect to see social networking sites such as Facebook, Flickr and Twitter being leveraged to infect large numbers of computers worldwide. It's critical to protect our customers, so our gateway threat prevention services automatically defend against exploits of the Internet Explorer vulnerability." Anyone who visits a site that's been hacked due to the IE vulnerability could be at risk. By exploiting the IE vulnerability, hackers can remotely take control of a user's computer as soon as the user visits a site that contains malicious code. Exploiting a component of Microsoft DirectShow, hackers are able to create HTML pages with malicious JavaScript parsed in an IE browser to infect users' computers' without their knowledge. The URL JavaScript is used to instantiate an instance of the vulnerable control and feed it a malformed image, likely to be logo.gif, causing it to crash and execute the malcode. Once initiated the hacker is able to launch a wide range of attacks on the computer that could include opening random files on the target machine, thus causing potential denial of service attacks. |