Advertisement
Australia markets closed
  • ALL ORDS

    8,153.70
    +80.10 (+0.99%)
     
  • ASX 200

    7,896.90
    +77.30 (+0.99%)
     
  • AUD/USD

    0.6518
    -0.0018 (-0.27%)
     
  • OIL

    83.05
    +1.70 (+2.09%)
     
  • GOLD

    2,241.00
    +28.30 (+1.28%)
     
  • Bitcoin AUD

    108,461.65
    +2,960.80 (+2.81%)
     
  • CMC Crypto 200

    885.54
    0.00 (0.00%)
     
  • AUD/EUR

    0.6039
    +0.0008 (+0.14%)
     
  • AUD/NZD

    1.0905
    +0.0025 (+0.23%)
     
  • NZX 50

    12,105.29
    +94.63 (+0.79%)
     
  • NASDAQ

    18,277.02
    -3.82 (-0.02%)
     
  • FTSE

    7,952.62
    +20.64 (+0.26%)
     
  • Dow Jones

    39,828.54
    +68.46 (+0.17%)
     
  • DAX

    18,492.49
    +15.40 (+0.08%)
     
  • Hang Seng

    16,541.42
    +148.58 (+0.91%)
     
  • NIKKEI 225

    40,168.07
    -594.66 (-1.46%)
     

Microsoft says it will fix an Internet Explorer security bug under active attack

Microsoft has confirmed a security flaw affecting Internet Explorer is currently being used by hackers, but that it has no immediate plans to fix.

In a late-evening tweet, US-CERT, the division of Homeland Security tasked with reporting on major security flaws, tweeted a link to a security advisory detailing the bug, describing it as "being exploited in the wild."

Microsoft said all supported versions of Windows are affected by the flaw, including Windows 7, which after this week no longer receives security updates.

The vulnerability was found in how Internet Explorer handles memory. An attacker could use the flaw to remotely run malicious code on an affected computer, such as tricking a user into opening a malicious website from a search query or a link sent by email.

ADVERTISEMENT

It's believed to be a similar vulnerability as one disclosed by Mozilla, the maker of the Firefox browser, earlier this week. Both Microsoft and Mozilla credited Qihoo 360, a China-based security research team, with finding flaws under active attack. Earlier in the week, Qihoo 360 reportedly deleted a tweet referencing a similar flaw in Internet Explorer.

Neither Qihoo, Microsoft, nor Mozilla said how attackers were exploiting the bug, who the attackers were, or who was being targeted. The U.S. government's cybersecurity advisory unit also issued a warning about current exploitation.

Microsoft told TechCrunch that it was was "aware of limited targeted attacks" and was "working on a fix," but that it was unlikely to release a patch until its next round of monthly security fixes — scheduled for February 11.

Microsoft assigned the bug with a common vulnerability identifier, CVE-2020-0674, but specific details of the bug have yet to be released.

When reached, a Microsoft spokesperson did not comment.