A computer security researcher and an antivirus company are warning Microsoft customers about an unpatched hole in the company's Internet Explorer Web browser that could allow a remote attacker to bypass security warnings and download malicious content onto vulnerable systems.
The warnings came after the hole was identified on the Bugtraq Internet security discussion list by someone using the name "Rafel Ivgi." The hole affects Internet Explorer (IE) version 6.0.0, including the version released with Windows XP Service Pack 2. The vulnerability allows malicious attackers to bypass warnings designed to inform users when a file is being passed to their computer using a specially-crafted HTML (Hypertext Markup Language) Web document.
Microsoft was not able to comment on the hole in time for this story.
Security software company Symantec Corp. issued a vulnerability alert about the hole Friday and cited Ivgi, which also provided code proving that the hole existed.
According to the Bugtraq message and Symantec alert, an IE feature designed to catch references to file downloads does not detect a particular HTML event, known as "onclick," when it is combined with the common HTML <BODY> tag, which designates the beginning and ending of the main part of a Web page.
Malicious Internet users could use the onclick event in combination with another function called "createElement" to create an IFRAME, or "inline frame," which is an HTML element that allows external objects to be inserted into another HTML document. Attackers could link the IFRAME to a malicious Web page that downloaded a malicious file to the user's computer when the page was clicked on, without generating a warning in the Information bar, Symantec said.
There is no patch available for the new hole, and no specific exploit code is required to take advantage of the hole, Symantec said.
IE users are advised to avoid links provided by unknown or untrusted sources, to keep from being lured to a malicious Web site. IE users can also configure the browser to disable the execution of script code and active content, though doing so could have adverse effects on the way IE functions, Symantec said.
The news comes just three days after Microsoft issued software patches for several serious Windows security holes and released a new tool that lets users remove malicious software from their PCs, and amid increasing competition in the Web browser market from the Mozilla Foundation's Firefox browser.
On Tuesday, the Redmond, Washington, software company published security bulletins and patches for two critical holes, one in the Windows HTML Help system and the other in Windows code that handles cursor, animated cursor and icon formats.(See: http://www.microsoft.com/technet/security/bulletin/MS05-001.mspx and http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx.)
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive InfoWorld Resource Alerts
Recommend This
