Double MyDoom for Internet Explorer flaw
104533
A second version of the MyDoom variant that uses a flaw in Internet Explorer has started to spread, antivirus researchers said on Tuesday.
298762
Microsoft's IE (Internet Explorer) browser has an unpatched vulnerability that could let hackers hijack, then access, Google Gmail accounts, a California security company warned Monday.IE, said Santa Clara-based Cenzic in an alert issued Monday, contains an unspecified cached files bug that, when combined with a cross-site request forgery flaw in the Web-based e-mail service, exposes Gmail account sign-ons and lets others access those accounts and any messages or file attachments there.Although not a bug that can be leveraged remotely -- an attacker must have local, physical access to the PC -- as Cenzic pointed out in its alert, there are scenarios where that's not a limitation. "These vulnerabilities could be exploited such that all users of a shared computer who use Internet Explorer and share a user account -- a common practice at computer kiosks in a library or Internet cafe -- could be vulnerable," said Cenzic.Gmail contributes to the overall vulnerability because its URLs display attachments when viewed using the "View Source" command, the warning went on. IE, however, sports "improper use of caching directives [and] incorrect access checks on cached Internet Explorer files."Together, the bugs could conceivably let someone at a public PC hijack any Gmail log-on credentials that had been entered on the machine since the IE cache had last been purged. IE deletes the contents of its cache only as new files are added -- and the oldest are deleted -- or when the user explicitly instructs the browser to clear the cache using the "Delete Browsing History" command.Microsoft denied that IE even has a bug. "Microsoft has thoroughly investigated the claim and found that this is not a product vulnerability," said a company spokesman Tuesday morning. "In the scenario in question, an attacker would need authenticated access to the system in order to modify files located in the cache. With that level of access, an attacker could install malicious programs that would have more impact than the scenarios described."While true, that did not address Cenzic's scenario; by design, public PCs such as those in libraries, schools or Web cafes do not require authentication to access. Microsoft was not available for clarification.Google did not immediately respond to questions about Gmail's part in the threat
715274
Microsoft Aims to Block AdSense  Don't titles rule! 'Extremely Critical' Flaw Threatens Internet Explorer Users was announced a few days ago. In that article, it tells users that "Microsoft is recommending that users turn off the "Drag and drop or copy and paste files" option in Internet Explorer and set security ...
591861
A vulnerability in a Java plug-in from Sun Microsystems used by most web browsers poses a risk for users of IE and alternative browsers alike.
124001
Firefox and Internet Explorer 7 do not properly handle JavaScript "onUnload" events and can be tricked into taking a user to the wrong URL, according to security researcher Michal Zalewski.
602689
(InfoWorld) - Hackers are taking advantage of aÂ newly discovered vulnerability in Internet ExplorerÂ to install spyware on PCs that visit a number of Russian porn sites. The malware, first reported Monday by researchers at Sunbelt Software Inc., takes advantage of an unpatched flaw in the way IE processes Vector Markup Language (VML) code. VML is a language used to display graphic information on the Web. The attack appears to work on all versions of Windows running the IE 6 browser, said Eric Sites, Sunbelt's vice president of research and development. "It's not an operating system-dependent issue," he said. Sunbelt first discovered the malware on a Russian porn site late Friday. "This site and a couple of others use an exploit kit called Web Attacker, and it looks like the Web Attacker kit has been upgraded to include this new exploit," Sites said. Since Friday, Sunbelt noticed that the attack code has popped up on about a half-dozen Russian porn sites. In addition, since security researchers estimate that Web Attacker is used by nearly 1,000 Web sites, this latest exploit should soon become more widespread. Web Attacker is a software development kit sold for as little as US$20 to criminals looking for an easy way to develop malware. "Since it's being built into the next version of the Web Attacker kit, we expect that this thing will be everywhere in a few days," said Sites. Whether the attacks will be widespread enough for Microsoft to rush to patch the flaw remains to be seen. On Tuesday, Microsoft confirmed the Sunbelt team's findings, and said it planned to fix the VML bug in its next set of security patches, scheduled to be released on Oct. 10, "or sooner as warranted," according to a statement from the company's public relations agency. This is the second unpatched flaw found in IE over the past week. On Sept. 14, researchers posted code that could be used to exploit a different vulnerability in a multimedia component of Internet Explorer. Microsoft is still investigating that flaw and is not saying whether it too will be patched next month. Sunbelt says that users can avoid the VML attack by disabling Javascript on their browsers. More information can be found on the Sunbelt blog,Â located here.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
89850
Microsoft has a technical work-around for users who found IE crashing after recent security update.
273091
Security experts are warning of a new and highly critical security flaw in Microsoft (Nasdaq: MSFT) Internet Explorer, when running under Windows XP SP2.
350470
Are MyDoom offshoots an attempt to throw Microsoft off-balance?
290860
Security researchers can't decide whether it's in IE or Firefox A serious vulnerability that causes Internet Explorer to launch Firefox and execute a malicious payload is sparking debate about exactly who is responsible for the flaw.â¦
539621
Researchers have found a trio of flaws in Internet Explorer--making almost 20 in total.
605863
com staff. Danish security firm Secunia has reported a &quot;moderately critical&quot; window injection vulnerability in Firefox, Internet Explorer, Opera, Netscape, Safari and Konqueror.
235692
Microsoft's recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.
166415
Microsoft has released an update to Internet Explorer to fix a security flaw that was discovered a month ago and has since been exploited to attack users.
729334
(InfoWorld) - A vulnerability in Microsoft Internet Explorer (IE) browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday. The flaw lies in the way IE7 processes a locally stored HTML (Hypertext Markup Language) error message page that is typically shown when the user cancels the loading of a Web page, said Aviv Raff, a security researcher based in Israel. The error message tells the user that "navigation to the webpage was cancelled," and offers the user the opportunity to "refresh the page." If the refresh link is clicked, IE can be tricked into displaying the wrong Web address for a page. Raff has published proof of concept code that shows how IE can be made to display a Web page on his Web site as if it is from the cnn.com domain. This flaw could be exploited by phishers who want to make their spoofed Web sites appear legitimate, Raff said. "I can inject a script that will display anything I want in the page when the user clicks the 'refresh' link," he said via instant message. "Combining this with the design flaw, an attacker can render in the browser whatever he wants with whatever URL he wants in the address bar." This type of bug is known as a cross-site scripting vulnerability. It affects IE 7 on Vista and Windows XP, Raff added. Microsoft could not immediately confirm Raff's findings, but the company issued a statement saying that it is investigating the issue and is "not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time."
524507
A variant of a bug that uses an Internet Explorer 6 vulnerability exposes Microsoft Windows systems patched with Service Pack 2. A security researcher claims to have crafted a simpler version of a bug first identified in late October.
29234
Security researchers have uncovered a spoofing flaw in Internet Explorer that could turn out to be the perfect holiday gift for scammers.