[ISN] New MyDoom variant exploits IE flaw

[InfoSec News]

http://www.nwfusion.com/news/2004/1109newmydoo.html

By Scarlet Pruitt
IDG News Service
11/09/04

A new variant of the MyDoom worm that exploits an unpatched flaw in
Microsoft's Internet Explorer browser is in the wild and posing
particular risk to home and small business users, security experts
warned this week.

The worm, which security firms dubbed MyDoom.AF, MyDoom.AH and
MyDoom.AG, spreads by e-mail and exploits a recently discovered buffer
overflow vulnerability in IE.

Internet users should avoid opening suspicious e-mail with the subject
headers "funny photos :)," "hello," "hey!" and blank headers,
according to security firm iDefense. Users who open the infected
e-mail and click on links in the message body will be directed to
destinations from which an attack may be launched.

Microsoft issued a statement saying that it was aware of the new
variant and an investigation is underway. According to early reports
the vulnerability does not exist on Windows XP Service Pack 2 (SP2) so
customers running the security update are at a reduced risk of the
threat, Microsoft said. The software maker and security experts
advised users to install SP2 if they have not already.

Users less likely to have a perimeter defense, such as those in homes
and small offices, are more vulnerable to attack, security experts
warned. The variant exploits a flaw in the way IE handles "iframe" and
"frame" HTML tags. Code that takes advantage of the flaw began
circulating last week and researchers warned that several new codes
exploiting the vulnerability may appear in the next few weeks since it
is still unpatched.

Microsoft said however that it believes the current threat is low and
that it is not aware of any significant customer impact. The company
added that it will decide what further action to take upon completing
its investigation and said it could issue a patch ahead of its regular
monthly security update.