The pressure on Microsoft to release an out-of-cycle patch for an IE flaw
which allowed Chinese hackers to attack Google's systems continues to grow,
after authorities in France joined the German government in urging citizens to
use an alternative browser.
Microsoft
admitted
late last week that the hack of Google's systems revealed on Tuesday was
caused by a vulnerability in version 6 of its popular browser.
"The vulnerability exists as an invalid pointer reference within Internet
Explorer," read a
Microsoft
security advisory.
"It is possible under certain conditions for the invalid pointer to be
accessed after an object is deleted. In a specially crafted attack, in
attempting to access a freed object, Internet Explorer can be caused to allow
remote code execution."
It later emerged that the exploit code for the flaw had
made
its way onto the internet, increasing the likelihood of copycat attacks.
The French and German authorities are now urging their citizens to use an
alternative browser until the flaw is fixed, and the pressure on Microsoft to
release an out-of-cycle patch is growing.
However, Microsoft is continuing to advise users to upgrade to the latest
version of the browser, which appears to be unaffected by the vulnerability.
Graham Cluley, senior technology consultant at security vendor Sophos, warned
that switching browsers may cause more problems than it solves in many cases.
"If your IT department doesn't already formally support an alternative brow
ser, and if your users aren't already familiar with the other browser, you may
be causing more problems than it's worth by summarily switching browsers," he
wrote in a
blog
posting today.
"You may also have web-based applications that don't work well, or even at
all, unless they are accessed with Internet Explorer. That's not going to be
good for productivity. And finally, what if your replacement browser itself
turns out to contain a vulnerability? Are you going to switch again?"
Do you agree?
Have your say on this article