MS fixes ‘moderate’ IE bug experts say is serious

Microsoft Corp. late Wednesday issued a patch to fix a flaw in Internet Explorer (IE) that it says poses only a “moderate” risk to users. Security experts, however, say the vulnerability is serious and could be exploited to take over a user’s machine.

The flaw affects IE 5.5 and IE 6.0 and lies in a feature meant to set up security boundaries between Web browser windows and the local system. Exploiting it could enable an attacker to read information on a user’s computer and invoke programs already on the PC, according to Microsoft in a security bulletin.

“This is an extensive downplaying of the severity,” says Thor Larholm, a Copenhagen-based security researcher with PivX Solutions LLC. “An attacker can in fact take any action on a system a local user could, including modifying files, formatting the hard drive and uploading applications.”

This “external object caching” vulnerability was first made public in late October by Israeli security company GreyMagic Software together with a score of other IE flaws.

An attacker could exploit the flaw by luring a user to an especially coded Web page or sending that page via HTML (Hypertext Markup Language) e-mail, Microsoft said. The Redmond, Wash., company advises users to consider applying the patch, which is part of a super patch that includes all previous IE 5.5 and IE 6.0 fixes.

Larholm, who has close ties to GreyMagic, warns that an exploit for the external object caching flaw will likely be out soon, since the flaw was first made public in October. He urges users to patch up as soon as possible. Another 18 publicly known but unpatched vulnerabilities remain in IE, of which six are serious, Larholm said.

Microsoft changed the way it rates security issues last month because customers complained they could not identify the most serious vulnerabilities, the company has said.

Under the new system, fewer bulletins get the “critical” stamp. The only vulnerabilities now rated critical are those that could be exploited to allow malicious Internet worms to spread without user action. Many issues that were previously rated critical are now “important,” a new category in the rating system. Important vulnerabilities could expose user data or threaten system resources.

Rated “moderate” are vulnerabilities that are difficult to exploit because of default configuration, auditing, or just plain difficulty of exploitation, according to Microsoft’s rating scheme.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now