Microsoft Warns That Internet Explorer Is Compromised In Yet Another Way

Oh Internet Explorer, why must you hurt us?  Yet another security hole was discovered today in that iconic browser we all know and love.  With more, here’s ZDNET:

Microsoft today issued a security advisory to acknowledge an information disclosure hole in its Internet Explorer browser and warned that an attacker could exploit the flaw to access files with an already known filename and location.

The vulnerability was first discussed at this week’s Black Hat DC conference by Jorge Luis Alvarez Medina, a security consultant with Core Security Technologies. Microsoft says the risk is highest for IE users running Windows XP or who have disabled the browser’s Protected Mode feature.

Medina’s presentation demonstrated how an attacker can read every file of an IE user’s filesystem. The attack scenario leveraged different design features of Internet Explorer that can be combined to do serious damage.

Here’s more on Medina’s talk from DarkReading’s Kelly Jackson-Higgins:

[Medina] says popular features in IE, such as URL Security Zones and the browser’s file-sharing protocol, can together be abused to execute an attack that results in the attacker being able to read all files on the victim’s machine. Medina plans to release proof-of-concept code for the attack next month after Black Hat DC, and after Microsoft issues a security update for the attack, which affects IE versions 6 and above, he says.

“These vulnerabilities are just features … the implementation of the features allow you to obtain certain information, which by itself is harmless. But when combined together with other features, it renders an attack vector,” Medina says. The attack requires the user to click on a malicious link.

According to Microsoft’s advisory, IE’s Protected Mode prevents exploitation of this vulnerability and is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008.

The problem does affect every version of the browser but is considered most serious on Windows XP.

The vulnerability exists due to content being forced to render incorrectly from local files in such a way that information can be exposed to malicious websites.

For pre-patch mitigations, see the “workarounds” section of Microsoft’s advisory.

Since the greatest number of copies of Internet Exploder are running on Windows XP, it should be noted how long it takes to deliver the fix for this (we are still in the period where security fixes are supposed to be delivered pronto). The holes in IE are like the ones in Emmenthaler cheese, which grow wider and larger with age.

Or perhaps the comparison should be made to cheese, when it stinks too much, you throw it out!