New Exploit Targets Internet Explorer

Researcher in New Zealand discovered holes in Microsoft's Web Proxy Automatic Discovery (WPAD) program.

One week before the last Patch Tuesday of 2007 and two weeks after a researcher in New Zealand discovered holes in Microsoft's Web Proxy Automatic Discovery (WPAD) program, Redmond this week issued its latest in a long line of security advisories.

Tim Rains of Microsoft's Security Response Center wrote in a blog post on Monday that Windows XP SP2, Windows Server 2003 SPs 1 and 2 and Windows Vista are all vulnerable to WPAD server manipulation.

This vulnerability also affects all supported versions of Internet Explorer, a browser which most commonly uses the WPAD function to locate an automatically configured proxy file to determine settings on offsite servers and by extension affecting Internet traffic flow through server indentification and authentication.

Potential vulnerabilities first came to light around Thanksgiving weekend when Redmond's software engineers responded to the results of a presentation made by Beau Butler, a New Zealander and self-described "ethical" hacker. Butler's work revealed that a hacker can use WPAD files to intercept and manipulate all Internet traffic on a given network. Butler said 160,000 computers in New Zealand alone could be seized with just one attack.

Media reports have claimed that U.S. computers are not vulnerable to the attack. However, it appears Microsoft isn't taking any chances, as the software giant said it released the security advisory as it investigates "new public reports of a vulnerability in the way Windows resolves hostnames that do not include a fully-qualified domain name."

Thus an issue that was supposed to have been resolved in 2005 has become a 2007 fix as the minute technical overhaul made back then only addressed the ".com" domain name, and not other suffixes such as ".org," ".tv," and non-U.S. country tags -- in the case of the hacker's findings, "nz."

This week, Microsoft added a new specification to the vulnerability profile stating that "Customers whose domain name begins in a third-level or deeper domain, such as "," are at risk.

Conversely, among those not at risk are IT shops where a manually specified proxy server is in place for IE. Additionally, those who have disabled the "Automatically Detect Settings" command in IE can also work around the issue.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Adds Privileged Identity Management Delegation to Azure Lighthouse

    The commercial release of Privileged Identity Management (PIM)-enabled Azure Lighthouse delegations is now available, Microsoft on Monday announced.

  • Microsoft Commercially Releases Entra Workload Identities

    Microsoft announced on Monday that its Entra Workload Identities service is now available as a commercial product offering, having reached the "general availability" stage.

  • The 2022 Microsoft Product Roadmap

    Microsoft has a lot in the docket for 2022, including new products like SQL Server 2022, Exchange Subscription Edition and Visual Studio 2022 for Mac.

  • OpenSSF Adopts Microsoft Open Source Software Security Guidelines

    The Open Source Security Foundation (OpenSSF) announced on Wednesday that it has adopted the Secure Supply Chain Consumption Framework (S2C2F) for ensuring the secure use of open source software (OSS) by developers.