Information Security News: Microsoft Patches Serious IE Flaw

[William Knowles <wk () c4i org>]

http://www.eweek.com/article2/0,4149,1485698,00.asp

By Dennis Fisher 
February 2, 2004 

Microsoft Corp. on Monday finally released a patch for a dangerous 
vulnerability that lets attackers trick Internet users into visiting 
malicious sites. The flaw has been public knowledge for some time, but 
Microsoft failed to include a fix for it with January's scheduled 
patch releases. 

The vulnerability has to do with the way IE parses URLs, specifically 
those that contain special characters. Using this weakness, an 
attacker can create a link that looks like it will send a user to a 
legitimate site, such as www.eweek.com. However, once the user clicks 
on the link, the attacker can cause content from another site to 
appear in the window. 

Microsoft typically releases security fixes on the second Tuesday of 
each month. But the seriousness of this vulnerability caused the 
company to publish this patch out of cycle. 

The company also released patches for two other flaws in IE Monday. 
One of the vulnerability is in the cross-domain security model in IE, 
which is supposed to keep windows in different domains from sharing 
data. But this weakness allows an attacker to run scripts on remote 
machines if he can force the user to visit a malicious Web site or 
open an HTML e-mail message. 

The other weakness involves dynamic HTML operations and allows an 
attacker to save a file on a target user's machine. The file would not 
execute automatically. 



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.