News

Microsoft Warns of Bug in IE

Microsoft has released a patch that eliminates a security vulnerability in Internet Explorer (IE). The vulnerability could allow a malicious user to read, but not add, change, or delete, certain types of files on the computer of a visiting user.

When a Web server navigates a window from one domain into another, the IE security model checks the server's permissions on the new page. It is possible, however, for a Web server to open a browser window to a client-local file, then navigate the window to a page that is in the Web site's domain in such a way that the data in the client-local file is accessible to the new window. The data would only be accessible to the new window for a very brief period, but the result is that it could be possible for a malicious Web site operator to view files on the computer of a visiting user. The operator would need to know or guess the name and location of the file, and could only view file types that can be opened in a browser window.

IE 4.0, 4.01, 5, and 5.01 are all affected by the vulnerability. Patches are available at http://www.windowsupdate.microsoft.com and http://www.microsoft.com/windows/ie/security/patch5.asp. -- Isaac Slepner

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Feds Takes Action Against Russian Firms for Spying

    The U.S. Department of the Treasury has issued sanctions against Russia and a handful of Russian organizations for spying and other cyberactivities.

  • Microsoft Previews 64-Bit OneDrive Client for Windows 10

    A preview of a 64-bit OneDrive client for x64 Windows 10 systems is now available for work, school or home users.

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • Microsoft Adds Data Loss Prevention Alerts to Compliance Toolbox

    The latest part of Microsoft's overall compliance tooling is its Data Loss Prevention Alerts Dashboard, now generally available.