Feeds

Guninski finds another IE 5.5 security hole

Does this man do anything else?

  • alert
  • submit to reddit

Internet Security Threat Report 2014

We have a problem with IE security bugs - they all look the same to us. So thank goodness for George Guninski, who's found yet another security hole in Microsoft's IE5.

The problem affects IE 5.5 and Outlook and Outlook Express, and exploits the compressed help file (.chm) format.

Guninski has found a problem with the .chm format before. Last time Microsoft patched it by requiring that the help files run from the local file system. But the problem has resurfaced because the new problem reveals the location of temporary Internet files or folders.

Guninski made the discovery public on the Bugtraq security mailing list. He wrote: "Once a temporary Internet files folder name is known, it is possible to cache a '.chm' in any temporary Internet files folder and then use 'window.showHelp()' to execute it.There are other ways to execute programs once a temporary Internet files folder is known and document is cached in it, but 'showHelp()' seems to be the simplest."

Guninski spends a lot of time finding holes in Microsoft's software. Previously the software giant has criticised him for the short notice period he gives before going public with the flaw. Guninski informed the company about the latest hole on 15 November. ®

Related Story

M$ moves slowly to patch latest IE 5.5 hole

Beginner's guide to SSL certificates

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
First in line to order a Nexus 6? AT&T has a BRICK for you
Black Screen of Death plagues early Google-mobe batch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?