Feeds

New IE5 security hole leaves PCs wide open to hacking

Switch it off, quick...

  • alert
  • submit to reddit

Intelligent flash storage arrays

The latest addition to IE5's list of security 'issues' is a corker. The problem, detailed by Microsoft here, allows a "malicious Web site operator" to gain access to the computers of people visiting the site. It uses the IE5 "download behaviour" feature, which is intended to allow Web page authors to download files for use in client-side scripts. This is intended only to apply to files in the same domain, but a server-side redirect can be used to bypass this. The net effect is that our malicious operator (who are these people anyway? - name the names) can get access to files on both the user's machine and the user's local intranet. There isn't a fix so far, although MS says it's working on a patch. In the meantime, it recommends stopping the download behaviour by disabling Active Scripting. A helpful Register reader who's done this reports that it isn't necessarily the ideal solution. He sends us a GIF of what happened after he applied Microsoft's workaround - it's an error message saying "An ActiveX control on this page is not safe. Your current security settings prohibit running unsafe controls on this page. As a result, this page may not display as intended." As far as we can see, apart from the error message, it doesn't display at all... ®

Internet Security Threat Report 2014

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.