Hackers have created a potent exploit for a six-month old vulnerability in Internet Explorer which was previously believed to be only a Denial of Service risk. A fresh exploit posted on computerterrorism.com proves that the security bug can be exploited to gain system access, even on systems running Windows XP with Service Pack 2. The flaw stems from a failure by IE to properly handle requests to the window() object.

Successful exploitation involves tricking a Windows user running IE into visiting a maliciously constructed website contain hostile JavaScript code. Users of both IE 5.5 and 6.x are potentially at risk. "Currently, the only way to protect against exploitation of this vulnerability is by disabling active scripting or by using another browser," said Thomas Kristensen, CTO of security notification firm Secunia.

Microsoft's holding statement on the issue can be found here. ®

Related stories

• Hackers use BBC story to bait IE exploit (31 March 2006)

  https://www.theregister.com/2006/03/31/ie_exploit_bbc_bait/

• Patches released for zero-day IE threat (29 March 2006)

  https://www.theregister.com/2006/03/29/ie_patches_released/

• Update glitch spins out IE7 beta testers (19 December 2005)

  https://www.theregister.com/2005/12/19/ie7beta_patch_glitch/

• MS releases IE überpatch (14 December 2005)

  https://www.theregister.com/2005/12/14/ie_uberpatch/

• Trojan exploits unpatched IE flaw (1 December 2005)

  https://www.theregister.com/2005/12/01/ie_exploit_trojan/

• Exploit for unpatched IE vuln fuels hacker fears (19 August 2005)

  https://www.theregister.com/2005/08/19/0day_ie_exploit_fears/

• Warning over unpatched IE bug (4 July 2005)

  https://www.theregister.com/2005/07/04/ie_vuln/

• Firefox exploit targets zero day vulns (9 May 2005)

  https://www.theregister.com/2005/05/09/firefox_0day_exploit/

• Drive-by Trojans exploit browser flaws (23 March 2005)

  https://www.theregister.com/2005/03/23/symantec_threat_report/