October 18, 2000 2:45 PM PDT
IE 5.5 hole lets hackers read files
- Related Stories
-
Microsoft patch eliminates new hole in server software
October 17, 2000 -
Bug hunter finds another hole in Microsoft IE browser
October 5, 2000 -
IE 5.5 hole lets hackers into personal records
September 26, 2000 -
IE security bug leaves files vulnerable
September 6, 2000 -
Experts corroborate Windows, IE security hole
August 15, 2000 -
Bug hunter spies holes in Windows, IE 5.x
August 14, 2000 -
IE 5.5 bugged in first week
July 14, 2000
Georgi Guninski of Bulgaria published his "high risk" advisory of the exploit Wednesday, warning of a security vulnerability in which a malicious person could read files and URLs after enticing someone to view a Web page or read an HTML message that the malicious person created.
"It's definitely a high risk," said Elias Levy, chief technology officer for SecurityFocus.com. "We assume that the only thing people can do is read files--that's pretty damaging in and of itself, but at least for now people aren't able to write or execute programs through your machine. They can only read files from your machine or read Web pages."
Levy added that a hacker could also get into someone's computer system by delivering an email of a Web page to someone who uses Outlook or Outlook Express.
Levy said that the problem appears to be in the code that bridges Internet Explorer and Java via the object tag.
The object tag is a way to run plug-ins, Java applets or other external programs within a browser.
Microsoft's Security Response Center said it is investigating the reported vulnerability, which the company was notified about Saturday.
"We are thoroughly investigating (the vulnerability) just like we do with all these," a Microsoft representative said. "We're very committed to keeping our customers' information safe. As soon as we have more information, we'll be sure to get that out to our customers."
Early this month, Guninski circulated another advisory that warned people using Microsoft's Internet Explorer 5.5 of a security hole that could let a hacker enter their computers and tinker with files.
