September 20th, 2006
Hardware DEP saves day again on VML IE exploit
After some testing on the VML zero-day exploit for Internet Explorer, I have managed to verify that hardware-enforced DEP will prevent the exploit from launching. IE will simply generate a DEP error asking you if you want to make a DEP exception for Internet Explorer (which you should say NO) and crash Internet Explorer. Without hardware-enforced DEP, my test machine would have been owned by a ton of Malware from the websites I was testing on.
This is the third time in a row that hardware-enforced DEP has preemptively protected me from a zero-day Internet Explorer exploit. The first time I verified this was with the WMF exploit, the second time was a zero-day IE exploit this March. Therefore I highly recommend people enable DEP protection in Windows XP SP2 and Windows Server 2003 SP1 and never buy a CPU without NX or XD capability. This DEP guide I did earlier this year is still relevant. It doesn’t have the newer CPUs listed but they all have DEP capability except the cheapest Socket A CPUs from AMD. But even with hardware-enforced DEP enabled, it is still a good idea to implement the workarounds for this VML exploit.
According to this blog (via Alex from Sunbelt BLOG), even software-enforced DEP will mitigate this VML issue. This was not the case in the WMF zero-day exploit when only hardware-enforced DEP would work which means it isn’t worthless in all situations. So even if you don’t have a modern CPU, you should follow this guide and implement DEP. I’m a bit nervous about software-enforced DEP because Microsoft originally stated that it would work against the WMF exploit and then had to retract that claim. But it’s better than nothing I guess.
George Ou is Technical Director of ZDNet. See his full profile and disclosure of his industry affiliations.
