Cable Forum - IE bug requires 'no user interaction'

Cable Forum (https://www.cableforum.uk/board/index.php)

- Security & Virus Discussion (https://www.cableforum.uk/board/forumdisplay.php?f=38)

- - IE bug requires 'no user interaction' (https://www.cableforum.uk/board/showthread.php?t=19683)

IE bug requires 'no user interaction'

security firm secunia has noted a security hole in microsofts internet explorer 6 for windows xp and 2003 that requires 'no user interaction' for the vulnerability to be sucessfully exploited.

Quote:

A boundary error in the handling of certain attributes in the IFRAME HTML tag is the cause of the vulnerability, Secunia has reported.

This can be exploited to cause a buffer overflow via a malicious HTML document containing overly long strings in the "SRC" and "NAME" attributes of the tag. Successful exploitation of the error allows execution of arbitrary code

MS has so far not issued a patch.

source: yahoo news

http://story.news.yahoo.com/news?tmp...03/tc_nf/28105

Re: IE bug requires 'no user interaction'

I think like all the recent problems, the people reporting them to the press are highly irresponsible in doing so before MS release patches.

Re: IE bug requires 'no user interaction'

Agreed - the story doesn't mention whether they already contacted MS about this... any security company worth their salt would do that. If they had already done this then it changes things a bit. Otherwise it is irresponsible of them.

Re: IE bug requires 'no user interaction'