By Robert McMillan
IDG News Service
November 25, 2009
Developers of the open-source Metasploit penetration testing toolkit
have released code that can compromise Microsoft's Internet Explorer
browser, but the software is not as reliable as first thought.
The code exploits an Internet Explorer bug that was disclosed last
Friday in a proof-of-concept attack posted to the Bugtraq mailing list.
That first code was unreliable, but security experts worried that
someone would soon develop a better version that would be adopted by
The original attack used a "heap-spray" technique to exploit the
vulnerability in IE. But for a while Wednesday, it looked as though the
Metasploit team had released a more reliable exploit.
They used a different technique to exploit the flaw, one pioneered by
researchers Alexander Sotirov and Marc Dowd, but Metasploit eventually
pulled its code.
Did a friend send you this? From now on, be the
first to find out! Subscribe to InfoSec News