The flaw affects IE 5.5 and IE 6.0 and lies in a feature meant to set up security boundaries between Web browser windows and the local system. Exploiting it could enable an attacker to read information on a user's computer and invoke programs already on the PC, according to Microsoft in security bulletin MS02-068. ( www.microsoft.com/technet/security/bulletin/MS02-068.asp)
"This is an extensive downplaying of the severity," says Thor Larholm, a Copenhagen-based security researcher with PivX Solutions. "An attacker can take any action on a system a local user could, including modifying files, formatting the hard drive and uploading applications."
This "external object caching" vulnerability was first made public in late October by Israeli security company GreyMagic Software ,together with a score of other IE flaws.
An attacker could exploit the flaw by luring a user to an especially coded Web page or sending that page via HTML e-mail, Microsoft said. It advised users to consider applying the patch, which is part of a super patch that includes all previous IE 5.5 and IE 6.0 fixes.
Larholm, who has close ties to GreyMagic, warned that an exploit for the external object caching flaw was likely to be out soon, since the flaw was first made public in October. He urges users to patch up as soon as possible. Another 18 publicly known but unpatched vulnerabilities remain in IE, of which six are serious, Larholm said.
Microsoft changed the way it rates security issues last month after customers complained they could not identify the most serious vulnerabilities.
Under the new system, fewer bulletins get the "critical" stamp. The only vulnerabilities now rated critical are those that could be exploited to allow malicious Internet worms to spread without user action. Many issues that were previously rated critical are now "important", a new category in the rating system. Important vulnerabilities could expose user data or threaten system resources.
Vulnerabilities rated "moderate" are ones that are difficult to exploit because of default configuration, auditing, or just plain difficulty of exploitation, according to Microsoft's rating scheme.