- Related Stories
-
Microsoft, Mozilla downplay browser bug
June 8, 2006 -
Bumper crop of Microsoft patches on the way
June 8, 2006 -
Critical flaws squashed in Firefox update
June 2, 2006
Code for both the vulnerabilities has been published, but there have been no reports of attacks taking advantage of the flaws, the SANS Internet Storm Center, which monitors network threats, said in an advisory released Wednesday.
SANS initially reported that one of the flaws also affected Mozilla's Firefox Web browser, but on Friday it said in an updated advisory that it had determined, after further research, that Firefox was not affected by it.
The first issue is related to the handling of a technology that is used to access documents delivered from one Web site to another, according to the advisory.
Attackers could exploit the IE flaw using cross-site scripting, said Monty Ijzerman, senior manager of McAfee's Global Threat Group. That technique enables hackers to view the contents of one open browser from a second browser open on the user's system. The attackers, as a result, could swipe sensitive information, such as online banking data, from one of the sites showing.
"We consider this flaw less serious than the other IE flaw," Ijzerman said. "A user would have to have multiple browsers open, and the information on the site would have to be relevant to what the attacker wanted."
The second security hole is related to the way HTA applications are processed. (This flaw is the one that SANS at first thought also existed in Firefox.)
A PC user could be tricked into double-clicking on a malicious file and remote code could be executed, Ijzerman said. An attacker could exploit the vulnerability to read files on a system or to install rootkits, which make system changes to hide another piece of possibly malicious software.
The two IE security flaws come as Microsoft releases its final beta version of IE 7, which is designed to offer more security features. SANS said Friday that IE7 does not have the security holes.
Microsoft said it is investigating the issues and has yet to hear of any attackers exploiting the reported vulnerabilities.
CNET News.com's Caroline McCarthy contributed to this story.
See more CNET content tagged:
advisory,
attacker,
flaw,
Microsoft Internet Explorer,
online banking
Why are people assuming, its a known browser thats going to be launched via the reported vulnerability.
Malware browsers are the new in thing for hackers, where they can customize the attack for the hacker's needs.
Of course, once these dedicated attack browsers are coded by "hackers" are used in attacks, they can get into the hands of the "script kid", where attacks of the nature i'm describing can become more wide spread and common place.
Right now dedicated browsers aren't being exploited in "script kid" attacks, basically as they don't have the programming knowledge.
Though there are dedicated malware browsers out there, distributed via "hacker" attacks, where it is the hacker's mini browser that opens via the attack, than commercial web browsers.
Keep your scope open here, and be prepared for more malware browsers being used in attacks.
This vulnerability reported in this article is a perfect environment for such a malware browser to be executed via this Internet Explorer / Firefox flaw.
No software is bug free.
If hackers dedicated enough time to Opera, it would have as many bugs in its browser, thats almost guaranteed.