Luke7k
08-20-2003, 12:01 PM
Microsoft Corp. on Wednesday issued patches for two new critical flaws in Internet Explorer.
The more dangerous of the two vulnerabilities results from IE's failure to properly check the object type that is returned from a Web server. It doesn't take much for an attacker to exploit this flaw; all that's needed is for a user on a vulnerable machine to visit an attacker's Web site. The attacker would be able to compromise the PC without the user doing anything but calling up the site.
Once the computer is compromised, the attacker could run any code of choice on the machine.
The second issue is in IE's cross-domain security model. This model is what prevents windows in different domains from sharing information. A weakness in the model could enable an attacker to execute code in the My Computer zone. In order to exploit this vulnerability, an attacker would need a user to visit a malicious Web page, at which point the attacker could run a script on the user's PC and cause the script to access data in a different domain.
It affects versions 5 and 6 of internet explorer.
More information and patch.
http://www.microsoft.com/windows/ie/downloads/critical/822925/default.asp (http://www.microsoft.com/windows/ie/downloads/critical/822925/default.asp)
The more dangerous of the two vulnerabilities results from IE's failure to properly check the object type that is returned from a Web server. It doesn't take much for an attacker to exploit this flaw; all that's needed is for a user on a vulnerable machine to visit an attacker's Web site. The attacker would be able to compromise the PC without the user doing anything but calling up the site.
Once the computer is compromised, the attacker could run any code of choice on the machine.
The second issue is in IE's cross-domain security model. This model is what prevents windows in different domains from sharing information. A weakness in the model could enable an attacker to execute code in the My Computer zone. In order to exploit this vulnerability, an attacker would need a user to visit a malicious Web page, at which point the attacker could run a script on the user's PC and cause the script to access data in a different domain.
It affects versions 5 and 6 of internet explorer.
More information and patch.
http://www.microsoft.com/windows/ie/downloads/critical/822925/default.asp (http://www.microsoft.com/windows/ie/downloads/critical/822925/default.asp)