On Monday, Jelmer Kuperus posted a message to the Full Disclosure mailing list to report the existence of new vulnerabilities in Internet Explorer, as well as exploits that take advantage of those flaws.
According to Kuperus, an unknown person tipped him to a Web page that installs adware onto unsuspecting users' system. Kuperus said the technique involved "serious handwork," meaning that the methods used by the person who developed the exploit are somewhat sophisticated and involve considerable knowledge of the Windows platform.
There is no patch available for at least one of the known vulnerabilities. The previously unknown vulnerabilities pertain to script-based URL location parameters as well as the ability to gain access to IE's trusted Intranet Zone.
In his analysis Kuperus also discovered the exploit uses script encoding techniques to obscure the actual code, which might help it bypass Web and virus filtering systems. Tools are available to reverse the script encoding, which help reveal the details of how the exploit works.
Microsoft learned of the exploit, which is apparently being used by people to inject adware into people's computers. The company told News.com that they consider it criminal to use an exploit to run a program, apparently implying that even if the program itself is legal, they see the use of an exploit to launch it as criminal activity. The company has contacted the FBI regarding the matter.
Secunia released an advisory about the problems, which the company considers "extremely critical." As a result of the new-found exploit and its severity we might see Microsoft release at least one new IE patch well before its next scheduled security patch release date of July 15.