News
New Exploit Targets Internet Explorer
Researcher in New Zealand discovered holes in Microsoft's Web Proxy Automatic Discovery (WPAD) program.
- By Jabulani Leffall
- December 05, 2007
One week before the last Patch Tuesday of 2007 and two weeks after a researcher in New Zealand discovered holes in Microsoft's Web Proxy Automatic Discovery (WPAD) program, Redmond this week issued its latest in a long line of security advisories.
Tim Rains of Microsoft's Security Response Center wrote in a blog post on Monday that Windows XP SP2, Windows Server 2003 SPs 1 and 2 and Windows Vista are all vulnerable to WPAD server manipulation.
This vulnerability also affects all supported versions of Internet Explorer, a browser which most commonly uses the WPAD function to locate an automatically configured proxy file to determine settings on offsite servers and by extension affecting Internet traffic flow through server indentification and authentication.
Potential vulnerabilities first came to light around Thanksgiving weekend when Redmond's software engineers responded to the results of a presentation made by Beau Butler, a New Zealander and self-described "ethical" hacker. Butler's work revealed that a hacker can use WPAD files to intercept and manipulate all Internet traffic on a given network. Butler said 160,000 computers in New Zealand alone could be seized with just one attack.
Media reports have claimed that U.S. computers are not vulnerable to the attack. However, it appears Microsoft isn't taking any chances, as the software giant said it released the security advisory as it investigates "new public reports of a vulnerability in the way Windows resolves hostnames that do not include a fully-qualified domain name."
Thus an issue that was supposed to have been resolved in 2005 has become a 2007 fix as the minute technical overhaul made back then only addressed the ".com" domain name, and not other suffixes such as ".org," ".tv," and non-U.S. country tags -- in the case of the hacker's findings, "nz."
This week, Microsoft added a new specification to the vulnerability profile stating that "Customers whose domain name begins in a third-level or deeper domain, such as "contoso.co.us," are at risk.
Conversely, among those not at risk are IT shops where a manually specified proxy server is in place for IE. Additionally, those who have disabled the "Automatically Detect Settings" command in IE can also work around the issue.
About the Author
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.