Internet Explorer file:// Request Zone Bypass Vulnerability
Internet Explorer is reported to be vulnerable to a zone bypass issue. Allegedly, if Internet Explorer attempts to open a web page containing numerous 'file://' requests each contained in a separate Iframe, the requested file will eventually be executed in the Local Computer zone.
Components Affected Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0
Recommendations Run all client software as a non-privileged user
with minimal access rights. Always run Internet Explorer as an unprivileged
user. This will limit the consequences of successful exploitation of this and
other latent vulnerabilities.
Do not follow links provided by unknown or
untrusted sources. Exploitation of this vulnerability can be accomplished by
following a link to a malicious website or by viewing maliciously crafted HTML
email. Caution should be exercised in accepting any communications from unknown
or untrusted users.
Currently we are not aware of any vendor-supplied
patches for this issue. If you feel we are in error or are aware of more recent
information, please mail us at: vuldb@securityfocus.com
. Microsoft Internet Explorer 5.5 SP2:
Microsoft Internet Explorer 5.5 SP1: Microsoft Internet Explorer 5.5:
Microsoft Internet Explorer 6.0 SP1: Microsoft Internet Explorer 6.0:
Article continues... Symantec - Security Response
Posted on Monday, 12 May 2003 @ 20:37:30 UTC by cj (7599 reads) [ Trackback ]
"Internet Explorer file:// Request Zone Bypass Vulnerability" | Login/Create an Account | 0 comments
The comments are owned by the poster. We aren't responsible for their content.
No Comments Allowed for Anonymous, please register
Login
· New User? · Click here to create a registered account.
Internet Explorer is reported to be vulnerable to a zone bypass issue. Allegedly, if Internet Explorer attempts to open a web page containing numerous 'file://' requests each contained in a separate Iframe, the requested file will eventually be executed in the Local Computer zone.
