Posted on Thursday, February 04 2010 @ 21:24 CET by Thomas De Maesschalck
Microsoft has confirmed that a newly discovered security flaw in Internet Explorer may allow information disclosure to malicious websites. All versions of Internet Explorer are affected, but Windows Vista and later are unlikely to be the target of an attack as long as Protected Mode isn't disabled.
Microsoft has issued Security Advisory (980088) to address a publicly disclosed vulnerability in Internet Explorer that may allow information disclosure for Windows XP users or for users who have disabled Internet Explorer Protected Mode. The advisory explains that content can be forced to render incorrectly from local files in such a way that information can be exposed to malicious websites.
The vulnerability was discussed in depth at this week's Black Hat DC conference by Jorge Luis Alvarez Medina, a security consultant with Core Security Technologies who revealed the issue a day after Microsoft released an out-of-band security bulletin for the browser. Here's the official description of the briefing: "In this presentation we will show how an attacker can read every file of your filesystem if you are using Internet Explorer. This attack leverages different design features of Internet Explorer entailing security risks that, while low if considered isolated, lead to interesting attack vectors when combined altogether. We will also disclose and demonstrate proof of concept code developed for the scenarios proposed."
More info
at ARS Technica.
