[ISN] Microsoft Patches Serious IE Flaw

From: William Knowles (wk@private)
Date: Tue Feb 03 2004 - 03:53:51 PST

  • Next message: William Knowles: "[ISN] Linux Security Week - February 2nd 2004"

    By Dennis Fisher 
    February 2, 2004 
    Microsoft Corp. on Monday finally released a patch for a dangerous 
    vulnerability that lets attackers trick Internet users into visiting 
    malicious sites. The flaw has been public knowledge for some time, but 
    Microsoft failed to include a fix for it with January's scheduled 
    patch releases. 
    The vulnerability has to do with the way IE parses URLs, specifically 
    those that contain special characters. Using this weakness, an 
    attacker can create a link that looks like it will send a user to a 
    legitimate site, such as www.eweek.com. However, once the user clicks 
    on the link, the attacker can cause content from another site to 
    appear in the window. 
    Microsoft typically releases security fixes on the second Tuesday of 
    each month. But the seriousness of this vulnerability caused the 
    company to publish this patch out of cycle. 
    The company also released patches for two other flaws in IE Monday. 
    One of the vulnerability is in the cross-domain security model in IE, 
    which is supposed to keep windows in different domains from sharing 
    data. But this weakness allows an attacker to run scripts on remote 
    machines if he can force the user to visit a malicious Web site or 
    open an HTML e-mail message. 
    The other weakness involves dynamic HTML operations and allows an 
    attacker to save a file on a target user's machine. The file would not 
    execute automatically. 
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomo@private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Tue Feb 03 2004 - 07:36:37 PST