(Copied/stolen from a post to newsgroup aol.newsgroups.help)
[ Tuesday, November 9, 2004
formatting link
Serious IE Hole Opens PCs Up to Attacks By Matthew Broersma November 4, 2004
US-CERT on Wednesday warned of a fresh hole in Internet Explorer:
formatting link
could allow attackers to take control of a PC via an HTML e-mail message or a malicious Web page. The flaw is all the more serious because exploit code has been published on public mailing lists, according to security researchers. ADVERTISEMENT The flaw, a heap buffer overflow, is in the way IE handles two attributes of the "frame" and "iframe" HTML elements. An exploit currently circulating uses overly long SRC and NAME attributes to cause IE to execute an attacker's shell code, according to US-CERT.
Read here why Peter Coffee says IE flaws should come as no surprise:
formatting link
Users could be attacked via a malicious Web page viewed in an affected version of IE or possibly through an HTML e-mail viewed in an application such as Outlook, Outlook Express, AOL or Lotus Notes that relies on the WebBrowser ActiveX control, according to researchers.
The bug has been confirmed in IE 6.0 on Windows XP with SP1 and all patches installed, as well as the same browser on a fully patched Windows 2000, according to an advisory from security firm Secunia:
formatting link
Corp. has not yet released a patch.
Windows XP systems running Service Pack 2 do not appear to be affected, researchers said. Apart from installing SP2, system administrators can lessen the danger of an attack by disabling active scripting, avoiding unsolicited links that may lead to a malicious Web page and rendering e-mails in plain text, US-CERT said. Updated anti-virus programs may also be able to prevent some exploit attempts.
For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer's Weblog:
formatting link
The fact that fully patched SP1 systems are vulnerable to the flaw, while SP2 systems are not, appears to show that the work put into Microsoft's security-oriented update is paying off. A spoofing flaw in IE publicized over the weekend:
formatting link
affects pre-SP2 systems but is largely disabled by the service pack.
Check out eWEEK.com's Security Center:
formatting link
the latest security news, reviews and analysis.
E-WEEK Special Report: Securing Windows:
formatting link