Microsoft Investigates Reports of New Internet Explorer Hole
268907
Microsoft is investigating reports of a serious security flaw in Internet Explorer, but has not yet seen malicious code that exploits the reported flaw, the company said today.
209227
Security researchers are warning of another pair of vulnerabilities in Microsoft Corp.&#39;s Internet Explorer browser affecting users on fully patched Windows XP Service Pack 2 systems.
86025
An Internet Explorer vulnerability first reported yesterday is already getting a workout. Malware utilizing the hole for installation is turning up on various Russian porn sites, with more trouble expected.
131081
TechWeb - Two new vulnerabilities in Internet Explorer 6.0 -- unveiled by a security firm Wednesday -- could be exploited by hackers to bypass security features in Microsoft's Windows XP SP2.
210968
com December 17, 2004, 11:40 AM PT. Microsoft is investigating reports of a new Internet Explorer flaw that puts people with the most secure version of Windows at risk of phishing attacks.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
417928
(InfoWorld) - Microsoft has released a patch for Internet Explorer 7 (IE7) that will boost the brand-new browser's performance on some Web sites. Some users had reported that the new phishing filter had been slowing down the PC's performance as IE evaluated the security of Web pages that contained a lot of frames. "When you use Windows Internet Explorer 7 to visit a Web page, the computer may respond very slowly as the phishing filter evaluates Web page contents," Microsoft said in a note published Tuesday. MicrosoftÂ introduced the filterÂ in IE7,Â released in mid-October, as a way of warning Web surfers when they might be visiting untrustworthy Web sites. The new patches are for Windows XP and Windows Server 2003 versions of IE7, but not for users running the browser on Windows Vista.
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
734050
SEATTLE  - Microsoft on Monday said it plans to take the unusual step of issuing a security patch as quickly as possible to stem a newly discovered flaw in its Internet Explorer Web browser that cybercrooks have already begun exploiting to take control of victims' computers.
524507
A variant of a bug that uses an Internet Explorer 6 vulnerability exposes Microsoft Windows systems patched with Service Pack 2. A security researcher claims to have crafted a simpler version of a bug first identified in late October.
745224
Security experts uncovered yet another bug in Internet Explorer this week, one that could let attackers replace the content of any legit site with their own, making it possible to spoof critical pages such as e-bank account access log-in forms or credit
759134
In a seeming replay of the uproar around last year's WMF vulnerability, a third-party patch has been released for the VML hole in Internet Explorer.
146749
One of the first flaws found in Windows XP SP2 -- which leaves a PC vulnerable through a drag-and-drop hole in Internet Explorer -- could be used by hackers for even greater mischief.
189086
Blog: Within hours of release, veteran researchers find holes in the new Windows browser from Apple.
414948
A critical flaw in Microsoft Corp.&#39;s (MSFT.O: Quote, Profile, Research) Internet Explorer Web browser could allow a hacker to take control of a computer, the world&#39;s largest software maker said on Wednesday.
660529
Just a week after Microsoft released a patch to plug a security flaw in the way at least 13 of its programs handle the JPEG imaging format, code appeared on the Internet on Wednesday showing how to exploit those holes.
175699
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) web browser allows attackers to create a fake website that looks exactly like a genuine site.