Microsoft Internet Explorer Remote Code Execution Vulnerability
Matthew Broersma writes in Techworld:
Fully patched Windows systems may be at risk from an unpatched, high-risk security hole affecting the latest version of Internet Explorer.
The bug, reported by security researcher Tom Ferris on his website, security-protocols.com, affects Internet Explorer 6 on a fully-patched Windows Server 2003 and Windows XP with Service Pack 2.
FrSIRT, the French Security Incident Response Team, confirmed the report and gave the flaw a "critical" rating, its most severe.
An attacker could exploit the bug to execute malicious code and take over a user's system, Ferris said. He said the attack works via a specially crafted Web page, doesn't need any user interaction and doesn't give the user any warning that code has been executed. The bug isn't related to previous Explorer flaws, Ferris said.
Microsoft has confirmed it is investigating the flaw, but hasn't yet said what action it will take, if any. Possible actions could include a patch included with the company's monthly patching cycle, or an out-of-cycle patch, if warranted, Microsoft said in a statement.
As of Wednesday afternoon, the company hadn't yet issued an advisory of its own, a relatively new practice it reserves for unpatched bugs.
posted by Fergie @ 9/02/2005 07:36:00 AM
0 Comments:
Post a Comment
<< Home