Greeting's

I found this on SANS. There are 2 new internet explorer vulnerabilities disclosed including PoC.
one of the vulnerabilities can be reproduced in firefox too.


critically rated IE vulnerability in the use of HTA applications (CLSID 3050f4d8-98B5-11CF-BB82-00AA00BDCE0B) to trick a user into opening a file by double clicking it. The file has to be accessible through either SMB or, according to the advisory, WebDAV, and can be located on a remote site. The currently available version of PoC that was published is limited in that it requires the user to double click on an icon to execute a potentially malicious payload, but we can expect to find creative use of this exploit in the wild very soon. The workaround for this appears to be disabling active scripting.


THIS ONE IS TOO NASTY

The second vulnerability is related to the handling of the object.documentElement.outerHTML property. The abuse of this property will allow an attacker to retrieve remote content in the context of the web page which is being currently viewed by the user. This vulnerability can be potentially nasty as attackers can use it to retrieve data from other web sites user is logged into (for example, webmail) and harvest user credentials. Several handlers have spent a little more time validating this particular issue and while it is a subtle exploit and rated a lower level risk, this issue has raised some of our neck hairs.
Regarding the second vulnerability, what's interesting is that we were able to reproduce this even when using Mozilla FireFox.


You can find more information here : http://isc.sans.org/diary.php?storyid=1448&rss

To test your browser go to this link : http://secunia.com/internet_explorer...erability_test

I recently read a thread about sandboxie, I think all members should have a loot at it at : http://www.sandboxie.com/