Results 1 to 2 of 2

Thread: IE Self Executing HTML Arbitrary Code Execution Vulnerability

  1. #1
    Senior Member
    Join Date
    May 2002

    IE Self Executing HTML Arbitrary Code Execution Vulnerability

    For all those using IE some reading for you - I haven't seen this commented on in AO yet, if I missed it I am sorry.

    A new IE hole that has recently been discovered seems to have missed the limelight. For most holes it isn't a major drama except this time it's a deadly one.



    Apparently a dangerous hole in IE 5.5-6 for which a patch has yet to be released and IE will execute code in the HTML regardless of the level of security you have it set at.

    From the BugTraq article...

    ... inject scripting and an executable into the html file which is designed to point back to the executable in the html file and execute it. Provided the html file is an html file, Internet Explorer 5.5 and 6.0 will execute it.

    Because it is an html file proper, Internet Explorer opens it. The scripting inside is then parsed and fired. That scripting is pointing back to the same executable file and because it is a self-executing html file, it executes !
    Might be time for some to test drive another browser for a little while. Mozilla & Opera are uneffected by this code.

    Take care people.

    Edit: Apparently the latest IE patch does not fix this.

  2. #2
    Senior Member
    Join Date
    Aug 2002
    Thanks for the advice and the info

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts