dcsimg
 

Microsoft Patches Serious IE Flaw

By Dennis Fisher  |  Posted 2004-02-02 Email Print this article Print
 
 
 
 
 
 
 

WEBINAR:
On-Demand

Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce


Microsoft doesn't wait for the second Tuesday to release a patch for dangerous vulnerability that lets attackers trick Internet users into visiting malicious sites.

Microsoft Corp. on Monday finally released a patch for a dangerous vulnerability that lets attackers trick Internet users into visiting malicious sites. The flaw has been public knowledge for some time, but Microsoft failed to include a fix for it with January's scheduled patch releases.

The vulnerability has to do with the way IE parses URLs, specifically those that contain special characters. Using this weakness, an attacker can create a link that looks like it will send a user to a legitimate site, such as www.eweek.com. However, once the user clicks on the link, the attacker can cause content from another site to appear in the window.

Microsoft typically releases security fixes on the second Tuesday of each month. But the seriousness of this vulnerability caused the company to publish this patch out of cycle.

The company also released patches for two other flaws in IE Monday. One of the vulnerability is in the cross-domain security model in IE, which is supposed to keep windows in different domains from sharing data. But this weakness allows an attacker to run scripts on remote machines if he can force the user to visit a malicious Web site or open an HTML e-mail message.

The other weakness involves dynamic HTML operations and allows an attacker to save a file on a target user's machine. The file would not execute automatically.

 
 
 
 
 
 
 
 
 
























By submitting your information, you agree that channelinsider.com may send you channelinsider offers via email, phone and text message, as well as email offers about other products and services that channelinsider believes may be of interest to you. channelinsider will process your information in accordance with the Quinstreet Privacy Policy.

 
 
 
 
 
 

Submit a Comment

Loading Comments...
























By submitting your information, you agree that channelinsider.com may send you channelinsider offers via email, phone and text message, as well as email offers about other products and services that channelinsider believes may be of interest to you. channelinsider will process your information in accordance with the Quinstreet Privacy Policy.

 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date