Time is ticking for Microsoft to produce a patch for the two-week-old Bofra exploit. But Redmond is still investigating the problem
After more than two weeks of investigating the IFRAME Bofra exploit, Microsoft has yet to announce when it will be able to fix the problem.
The software giant was unable to provide any further answers to ZDNet UK as to when it expects to resolve the flaw for its customers. In a prepared email statement from the company, a spokesperson said: "Microsoft is actively investigating new public reports of a criminal attack, known as Bofra, attempting to exploit a vulnerability in Internet Explorer's treatment of an HTML element known as IFRAME."
The spokesman added that Microsoft is working to forensically analyse the malicious code in Bofra and "will work with international law enforcement to identify and bring to justice those responsible for this malicious activity".
The exploit affects Internet Explorer 6.0 on Windows 2000 and XP SP1. Computers running SP2 are said not to be affected by the exploit.
Earlier this week, several Web sites were hit with banner ad Bofra exploits that directed users to other sites and downloaded malicious code onto their machines.
Analyst company Gartner has predicted that hackers will increase their use of the banner ad attack because of its wide-spread effectiveness.
The software giant added: "Microsoft is taking this vulnerability very seriously; accordingly an update to correct the vulnerability is currently in development. We will release the security update when the development and testing process is complete, and the update is found to effectively correct the vulnerability."
Microsoft has attacked independent researchers who made the IFRAME flaw publicly available. Within a few days of its publication, hackers had created an exploit for the vulnerability.
The company said that people who believe they have been attacked should contact their local law enforcement agency.
ZDNET News
