Researchers reveal new Explorer, Outlook security flaw

David Legard, IDG News Service   Today’s Top Stories    or  Other Spam, Malware and Vulnerabilities Stories  

Avoiding the Latest Phishing Attacks Computerworld presents a 100% free and online security event today! Client Security Podcast Intercept Spam & Viruses Spam Spikes: A Real Risk to Your Business What to Ask When Evaluating Messaging Security Systems Sign up to receive Security Resource Alerts

July 11, 2002 (IDG News Service) -- Researchers have identified a fresh security flaw in Microsoft Corp.'s Internet Explorer Web browser and Outlook e-mail client that can leave systems open to malicious code inserted in e-mails or Web pages, network security consultancy PivX Solutions LLC said yesterday.
The hole is created by what is known as a cross-domain scripting flaw. In this case, it means that HTML Version 4 objects embedded in Web pages and e-mails can include code that allows an attacker to access vulnerable machines, read files and documents, and execute programs on the computer, PivX said in an advisory.
PivX described the vulnerability as "extremely high risk," as it allows the arbitrary execution of programs, unprivileged reading of files and stealing of server cookies.
The flaw occurs because of the Object element used to embed external objects inside an HTML 4 page. Such objects can be the WebBrowser control and other ActiveX controls, images, applets and more. The Object property of embedded WebBrowser controls isn't subject to the cross-domain security checks that embedded HTML documents ordinarily go through, and as such it is possible to escape any sandboxing and security zone restrictions, PivX said.
In testing, PivX has demonstrated the flaw in Internet Explorer 5.5 running on both Windows 98 and Windows NT and on Internet Explorer 6 running on Windows 2000. The flaw also affects the Outlook and Outlook Express e-mail clients.
A quick work-around for end users involves disabling ActiveX, or setting "Script ActiveX controls marked safe for scripting" to Prompt or Disable, according to the PivX advisory.
The flaw was discovered on June 25, and Microsoft was informed the same day, PivX said.
PivX decided to release its findings in the light of a survey last month by consulting firm Hurwitz Group Inc. in Framingham, Mass., regarding the disclosure of security flaws.
"End users surveyed for the report are clearly angry that vendors are releasing insecure applications and then not responding when flaws are detected," Hurwitz wrote in the report. "While it seems that putting their own companies at risk (by publicizing a flaw before a patch is available) seems counterintuitive, end users are so frustrated with unresponsive vendors that they are willing to try almost anything."

Reprinted with permission from

For more news from IDG visit IDG.net
Story copyright 2006 International Data Group. All rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"A couple of weeks ago at..." Read more... "Most security companies tend to take a horizontal approach looking to capitalize on the finance, service provider, and federal government..." Read more... Read more Security posts or See all Blogs

Elgan: You can be Batman, too Study: IT jobs will drop in 2009 RIM fixes critical BlackBerry Enterprise Server bug More top stories...

Apple's recall demand would probably kill Psystar, says IP attorney DNS flaw discoverer says more permanent fixes will be needed AT&T muffs free iPhone Wi-Fi offer again

11 cool new apps for the iPhone With the opening of Apple's App Store, the iPhone takes a revolutionary leap from cool mobile phone to hot mobile platform. See our list of apps you should definitely check out for yourself. Google is doing WHAT? Its motto is "Don't be evil" — but it looks like anything and everything else imaginable is pretty much fair game — not to mention some wildly rumored projects that we asked the company to confirm or deny. The new face of R&D: What's cooking at IBM, HP and Microsoft The talk at three big research houses is all about "open innovation." Is that a feel-good catchphrase or the R&D strategy of the future? Review: The iPhone 3G was worth the wait After months of waiting for a 3G-based iPhone — and hours waiting in line to actually buy one — Ryan Faas says it "packs quite a punch, both in its design and in the 3G and GPS capabilities" it offers. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this webcast, free, compilments of Webroot Software Go to the webcast  Managing Mobile Data with Endpoint Security for Laptops Download this white paper now, compliments of Computerworld and Absolute Software. (Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error. Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network. Download this executive briefing  Top 10 Reasons to Upgrade Get this white paper now! (Source: Symantec) Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. New Fujitsu High-End Itanium Windows- and Linux-Based PRIMEQUEST Servers Offer the Utmost in High Availability New Fujitsu High-End Itanium-Based PRIMEQUEST Servers Offer Industry-Leading System Management for Linux and Windows Web Security SaaS: The Next Generation of Web Security View more whitepapers

• Elgan: You can be Batman, too
• Study: IT jobs will drop in 2009
• RIM fixes critical BlackBerry Enterprise Server bug
• More top stories 

Try Fluke Networks' EtherScope Analyzer on your network FREE Quickly solve the wide range of problems you encounter - 10, 100 and Gigabit, twisted pair and optical fiber, LAN or wireless LAN. The EtherScope Analyzer combines the essential tools you need to monitor network traffic and switch interfaces, discover devices, networks, VLANs, access points, mobile clients and more. See the power of this portable network analyzer on your network. Request free trial now *Terms and conditions: Evaluation units are available only for a limited time and will be scheduled on a first-come first-served basis. Not available in all geographies. Limited quantities available; customers requesting evaluation units may be waitlisted for the next available unit. It will be at the discretion of Fluke Networks to accept or decline requests for this free evaluation.