MS fixes 'moderate' IE bug but experts say it is serious

News

MS fixes 'moderate' IE bug but experts say it is serious

Microsoft issued a patch to fix a flaw in Internet Explorer that it said poses only a "moderate" risk to users. Security experts, however, say the vulnerability is serious and could be exploited to take over a user's machine.

The flaw affects IE 5.5 and IE 6.0 and lies in a feature meant to set up security boundaries between Web browser windows and the local system. Exploiting it could enable an attacker to read information on a user's computer and invoke programs already on the PC, according to Microsoft in security bulletin MS02-068. ( www.microsoft.com/technet/security/bulletin/MS02-068.asp)

"This is an extensive downplaying of the severity," says Thor Larholm, a Copenhagen-based security researcher with PivX Solutions. "An attacker can take any action on a system a local user could, including modifying files, formatting the hard drive and uploading applications."

This "external object caching" vulnerability was first made public in late October by Israeli security company GreyMagic Software ,together with a score of other IE flaws.

An attacker could exploit the flaw by luring a user to an especially coded Web page or sending that page via HTML e-mail, Microsoft said. It advised users to consider applying the patch, which is part of a super patch that includes all previous IE 5.5 and IE 6.0 fixes.

Larholm, who has close ties to GreyMagic, warned that an exploit for the external object caching flaw was likely to be out soon, since the flaw was first made public in October. He urges users to patch up as soon as possible. Another 18 publicly known but unpatched vulnerabilities remain in IE, of which six are serious, Larholm said.

Microsoft changed the way it rates security issues last month after customers complained they could not identify the most serious vulnerabilities.

Under the new system, fewer bulletins get the "critical" stamp. The only vulnerabilities now rated critical are those that could be exploited to allow malicious Internet worms to spread without user action. Many issues that were previously rated critical are now "important", a new category in the rating system. Important vulnerabilities could expose user data or threaten system resources.

Vulnerabilities rated "moderate" are ones that are difficult to exploit because of default configuration, auditing, or just plain difficulty of exploitation, according to Microsoft's rating scheme.

Email Alerts

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
 

COMMENTS powered by Disqus  //  Commenting policy