ANOTHER SECURITY FLAW identified in Microsoft's IE 5.5 and 6.0 Web browsers has the potential to give a remote user access to a host computer, according to security company Online Solutions.

   ADVERTISEMENT
  

Free IT resource

Virtualization Insights from Top Experts - Learn how virtualization gets real!

Sponsored by Dell

Free IT resource

TechNet: More ways to know it, share it, and keep it running.

Sponsored by Microsoft

RELATED LINKS
»  IE 7 bug reopens debate over patch responsibilities
»  Woman ordered to pay for file-sharing will appeal
»  McAfee to buy SafeBoot for $350M
»  Security RSS feed 

IDG ENTERPRISE NETWORK
• Research Reports  (CIO)
• Ask the Expert  (CIO)

TOP NEWS 


IT SOLUTION SEARCH
The attack exploits IE's built-in gopher client. Gopher is a nearly obsolete protocol for accessing remote directories and files which has been largely superseded by the Web and Hypertext Transfer Protocol (HTTP).

The part of code in IE which parses gopher replies contains an exploitable buffer overflow bug. A malicious server may be used to run arbitrary code on an IE user's system, Online Solutions said in a security advisory issued Tuesday.

The attack can be launched via a Web page or an HTML mail message which redirects the user to a malicious gopher server when the user views them. The exploiter could do anything that a regular user could do on the system -- retrieve, install, or remove files, upload and run programs.

IE users can protect themselves from the flaw by disabling the gopher protocol and since very few gopher servers still exist on the Internet today, this is unlikely to cause operational problems, the company said.

Jyväskylä, Finland-based Online Solutions said it informed Microsoft of the vulnerability on May 20 and that Microsoft has indicated it is working on a patch.

Until a patch is released, Online Solutions suggest that users follow a simple way to disable processing and displaying gopher pages by defining a non-functional gopher proxy in Internet Options.

Users should; select Tools -> Internet options -> Connections; click on "LAN settings"; check "Use a proxy server for your LAN"; click on "Advanced..."; in this area where users can define proxy servers to be used with different protocols, go to the Gopher text field and enter "localhost", and "1" in the port text field.

This will stop Internet Explorer from fetching any gopher documents, the company said.