The U.S. Department of Homeland Security and the United Kingdom advised computer users to consider using alternatives to Microsoft Corp.’s Internet Explorer browser until the company fixes a security flaw that hackers have used to launch attacks.
The bug is the first high-profile security flaw to emerge since Microsoft stopped providing security updates for Windows XP earlier this month.
That means PCs running the 13-year old operating system could remain unprotected against hackers seeking to exploit the newly uncovered flaw, even after Microsoft figures out how to defend against it.
Elsewhere, the US Computer Emergency Readiness Team (US-CERT) also said that it is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer (IE).
This vulnerability affects IE versions 6 through 11 and could allow unauthorized remote code execution. It has therefore advised users to stop using Internet Explorer until Microsoft can fix it.
The UK-CERT also made similar recommendation in its announcement which specifically advised user that ‘to mitigate this vulnerability for machines running Windows XP, users should consider downloading Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) 4.1, which in its default configuration should help to mitigate this vulnerability.
Further detail on this and other mitigation measures are available on the Microsoft website.
Users should also consider using alternative browsers, such as Google Chrome and Mozilla Firefox; and ensure that their antivirus software is current and regularly updated.’
This is an unusual alarm coming as it did from government agencies. Both agencies agree that Microsoft Internet Explorer contains a use-after-free vulnerability, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Although it is not strange that Computer Emergency Readiness Teams in UK and the US regularly issue announcement and advices on browsers, this is one of the few times that the CERT teams have recommended that people avoid using a specific browser.