  |
The Register: Three New MS Security Holes - Two Nasty - http://www.theregister.co.uk/2002/02/22/three_new_ms_security_holes/
Includes: MSXML may ignore IE security zone settings during a request for data from a Web site; and a VBscript problem which allows an attacker to read files on a victim's local drive, or eavesdrop on his browsing session. |
| |
The Register: MS Security Patch Fails on Local Files - http://www.theregister.co.uk/2002/04/02/ms_security_patch_fails/
The MS patch intended to fix a data binding flaw in IE, which enables a script to call executables on your Windows machine using the object tag, does not protect against malicious files launched from a local directory. |
| |
Privacy Secrets of MicroSoft's Internet Explorer - http://phaster.com/unpretentious/browsing_micro$oft.html
Security and internet privacy issues of Global Histories, Cookies, and Cache while browsing with Mac Explorer 5.0 |
| |
The Register: Cumulative IE Patch for Maicious Cookies - http://www.theregister.co.uk/2002/04/01/cumulative_ie_patch_for_malicious/
A fairly serious flaw in Internet Explorer which would enable a malicious Web page or e-mail to drop a cookie containing an HTML script on a victim's machine and run it in the 'Local Computer' zone rather than the Internet zone to avoid restrictions has just been patched. |
| |
The Register: IE, Outlook Run Malicious Commands Without Scripting - http://www.theregister.co.uk/2002/03/04/ie_outlook_run_malicious_commands/
An attacker can run arbitrary commands on Windows machines with a simple bit of HTML, an Israeli security researcher has demonstrated. The exploit will work with IE, Outlook and Outlook Express even if active scripting and ActiveX are disabled in the browser security settings. |