Feeds

New IE5 security hole leaves PCs wide open to hacking

Switch it off, quick...

  • alert
  • submit to reddit

The essential guide to IT transformation

The latest addition to IE5's list of security 'issues' is a corker. The problem, detailed by Microsoft here, allows a "malicious Web site operator" to gain access to the computers of people visiting the site. It uses the IE5 "download behaviour" feature, which is intended to allow Web page authors to download files for use in client-side scripts. This is intended only to apply to files in the same domain, but a server-side redirect can be used to bypass this. The net effect is that our malicious operator (who are these people anyway? - name the names) can get access to files on both the user's machine and the user's local intranet. There isn't a fix so far, although MS says it's working on a patch. In the meantime, it recommends stopping the download behaviour by disabling Active Scripting. A helpful Register reader who's done this reports that it isn't necessarily the ideal solution. He sends us a GIF of what happened after he applied Microsoft's workaround - it's an error message saying "An ActiveX control on this page is not safe. Your current security settings prohibit running unsafe controls on this page. As a result, this page may not display as intended." As far as we can see, apart from the error message, it doesn't display at all... ®

5 things you didn’t know about cloud backup

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
No, thank you. I will not code for the Caliphate
Some assignments, even the Bongster decline must
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Banking apps: Handy, can grab all your money... and RIDDLED with coding flaws
Yep, that one place you'd hoped you wouldn't find 'em
Video of US journalist 'beheading' pulled from social media
Yanked footage featured British-accented attacker and US journo James Foley
Primetime precrime? Minority Report TV series 'being developed'
I have to know. I have to find out what happened to my life
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
Judge nixes HP deal for director amnesty after $8.8bn Autonomy snafu
Lawyers will have to earn their keep the hard way, says court
Ex-IBM CEO John Akers dies at 79
An era disrupted by the advent of the PC
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.