Microsoft mulls early IE patch release

Microsoft may offer an Internet Explorer security update before its next official Patch Tuesday.

The update is being designed to fix a serious flaw in the way the widely used Web browser handles certain graphics files. The flaw, first reported last week, is increasingly being used in attacks on IE users, security experts warned Monday.

“We have been working nonstop on an update,” a Microsoft representative wrote on a corporate blog Friday. The patch is being tested now, and if it is done before Microsoft’s next scheduled patch release day on Oct. 10, the company will release it, the representative wrote.

Attacks that exploit the flaw have been broadening and now also use e-mail as a way to lure people to malicious Web sites, security company Websense said Monday. “We are starting to see mass mailing lures for Web sites that are hosting…exploit code,” Websense said.

In one example, cybercrooks have adapted a scam that uses e-cards to also take advantage of this latest IE flaw. The scam involves e-mail messages that at first glance appear to be greeting cards, but clicking on the link to view the card sends the target to a malicious Web site that tries to silently install keystroke-logging software.

The vulnerability lies in a Windows component called “vgx.dll.” This component is meant to support Vector Markup Language documents in the operating system. VML is used for high-quality vector graphics on the Web.

Read more: CNET News.com