Following in the footsteps of Germany last week, France is now advising its population to use an alternative browser pending a patch for an Internet Explorer vulnerability.
The French Computer Emergency Response Team (CERT) published an advisory on Friday January 15 stating "pending a patch from the publisher, CERT recommends using an alternative browser." In the advisory Internet Explorer 7 and 8 are both listed despite Microsoft confirming the vulnerability is only being exploited on Internet Explorer 6 currently. The flaw exists in IE 7 and 8 but at the moment there is only exploit code available for IE 6.
Last week the German Federal Office for Security in Information Technology (BSI) issued a similary advisory urging its population to stop using IE. According to the BSI the flaw will, put simply, "perform reconnaissance and gain complete control over the compromised system." The BSI noted that even running Internet Explorer in Protected Mode isn"t enough to stop the flaw. Microsoft issued further insight into the vulnerability this morning in a company blog posting. The software giant confirmed the exploit is only effective against Internet Explorer 6.
Google said, in a blog posting on January 12, that in mid-December, they, along with a number of other large companies in the Internet, finance, technology, media and chemical sectors, were targeted in a sophisticated cyber-attack. This attack on their infrastructure originated in China, using Internet Explorer 6, and resulted in the theft of intellectual property. Due to this attack, and the background behind it, Google is now taking a second look at their operations in China, particularly Google.cn, where they currently offer censored search results as part of an agreement with China"s government. Microsoft admitted last week that Internet Explorer 6 was one of the vectors used in the targeted and sophisticated attacks.