IE Self Executing HTML Arbitrary Code Execution Vulnerability
For all those using IE some reading for you - I haven't seen this commented on in AO yet, if I missed it I am sorry.
Quote:
A new IE hole that has recently been discovered seems to have missed the limelight. For most holes it isn't a major drama except this time it's a deadly one.
http://securityresponse.symantec.com...tent/8984.html
http://www.securityfocus.com/archive/1/343521
http://www.sc0re.com/modules.php?op=...rder=0&thold=0
Apparently a dangerous hole in IE 5.5-6 for which a patch has yet to be released and IE will execute code in the HTML regardless of the level of security you have it set at.
From the BugTraq article...
Quote:
... inject scripting and an executable into the html file which is designed to point back to the executable in the html file and execute it. Provided the html file is an html file, Internet Explorer 5.5 and 6.0 will execute it.
Because it is an html file proper, Internet Explorer opens it. The scripting inside is then parsed and fired. That scripting is pointing back to the same executable file and because it is a self-executing html file, it executes !
Might be time for some to test drive another browser for a little while. Mozilla & Opera are uneffected by this code.
Take care people.
Edit: Apparently the latest IE patch does not fix this.
