MICROSOFT'S INTERNET EXPLORER Web browser has a security vulnerability that could let a malicious Webmaster take over a user's computer, a security expert said Monday.

   ADVERTISEMENT
  

Free IT resource

Virtualization Insights from Top Experts - Learn how virtualization gets real!

Sponsored by Dell

Free IT resource

TechNet: More ways to know it, share it, and keep it running.

Sponsored by Microsoft

RELATED LINKS
»  IE 7 bug reopens debate over patch responsibilities
»  Woman ordered to pay for file-sharing will appeal
»  McAfee to buy SafeBoot for $350M
»  Security RSS feed 

IDG ENTERPRISE NETWORK
• Research Reports  (CIO)
• Ask the Expert  (CIO)

TOP NEWS 


IT SOLUTION SEARCH
Georgi Guninski, a well-known Bulgarian bug hunter, on Monday posted a security advisory on his Web site, www.guninski.com. Guninski ranks the problem as high risk.

Malicious Webmasters can exploit so-called ".chm" files, a compressed help file format, to execute arbitrary programs on a user's computer, Guninski said. The bug also allows viewing of temporary Internet files stored on the user's hard drive.

Guninski said he reported a similar vulnerability to Microsoft "some time ago." The software was fixed by allowing .chm files to run programs only if the .chm was loaded from the local system. Guninski says this is no longer a limitation. He discovered a way Webmasters could access temporary Internet files on other users' machines. Explorer saves pages in a folder called "temporary Internet files."

"It is possible to find the temporary Internet files folder," Guninski said.

Explorer creates several of these folders on a PC using random names. With a special HTML document, a malevolent Webmaster can reveal the name and location of a temporary Internet files folder.

Once a folder name is known, it is possible to cache a .chm file in any folder and execute it, Guninski said.

Until Microsoft has issued a patch for the problem, users can protect their computer by disabling active scripting, a browser function that has repeatedly been associated with security issues.

Affected programs are Microsoft's Internet Explorer, versions 5 and higher. Because Explorer is integrated in Microsoft's e-mail clients, Outlook and Outlook Express are also affected. Other versions may also be unsafe, but those have not been tested, Guninski said in his advisory.

Redmond, Wash.-based Microsoft could not be immediately reached for comment.