Feeds

Poison applet blights browsers

Hijack risk to IE and Netscape

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Crackers can use a malicious Java applet to hijack Internet sessions - leaving victims not so blissfully unaware.

Exploiters can re-direct Web traffic once it has left the proxy server to a destination of the attacker's choice, Microsoft warns.

Because of the vulnerability, a variety of man-in-the middle attacks are possible; attackers could also use the bug to filch session information, such as user names or passwords sent without using SSL encryption. Sensitive information sent using SSL will be protected from potential attackers exploited the vulnerability in unpatched systems, Microsoft advises.

A system is vulnerable only if IE is used in conjunction with a proxy server; this limits the risk to home users but isn't much help to businesses, where the proxy server architecture is very common.

The software giant has issued a patch which it describes as "critical" for client systems. Netscape advises users to upgrade to either version 6.2 and 6.2.1 of its browser (which includes an updated Sun JVM plug-in) that guards against this potential risk. ®

External link

Security advisory by Harmen van der Wal, who discovered the bug
MS advisory: Java Applet Can Redirect Browser Traffic
Sun JVM (Java Virtual Machine) Issue

Related stories

IE, Outlook run malicious commands without scripting
Three new MS security holes - two nasty
MS releases mother of all IE security patches
Who needs hackers when we've got MS?

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.