Microsoft warns of fresh IE, Windows flaws |
 |
By Bill Brenner, Senior News Writer
08 Feb 2006 | SearchSecurity.com |
|
|
Microsoft issued two advisories late Tuesday, warning that attackers could exploit fresh flaws in Internet Explorer (IE) and Windows to launch malicious code or gain elevated system privileges.
The first advisory deals with IE.
"Microsoft is investigating new public reports of a vulnerability in Internet Explorer," a Microsoft spokesman said by e-mail. "Based on that investigation, this vulnerability could allow an attacker to execute arbitrary code on the user's system when the user views a specially crafted Windows meta file (WMF) image. The user could view this image on a Web site, as an attachment in an e-mail or view an HTML e-mail of Outlook Express or Outlook."
The unspecified security hole affects IE 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4, and IE 5.5 Service Pack 2 on Microsoft Windows Millennium. The software giant recommended users upgrade to Internet Explorer 6, which isn't affected by the glitch. Also, the issue doesn't affect IE for Windows XP Service Pack 1 and Windows XP Service Pack 2.
The second advisory concerns a security hole in Windows.
"Microsoft is aware of public reports of a tool developed by a security researcher that reads access-control configuration information from the Windows registry, file system, and service control manager database, and feeds raw configuration data to the model," the spokesman said.
As a result, he said, "Microsoft is investigating reports that application of this tool to certain versions of Windows may have discovered possible vulnerabilities in Windows and the ability to allow a malicious user to launch a privilege-escalation attack caused by misconfigurations of the access-control lists."
The company said it is not aware of any attacks attempting to exploit the flaws and that it will continue to investigate, providing additional guidance for customers as necessary.
The advisories came a day after the software giant acknowledged it was looking into reports of another Windows flaw, for which exploit code is circulating.
A vulnerability research group has released details of a security hole attackers could exploit in the Microsoft Windows standard help system to cause a buffer overflow or launch malicious code.
Research site bratax.be said the problem is in Microsoft HTML Help Workshop. "A remote user can cause arbitrary code to be executed on a target computer when the target user opens a malicious .hhp file," bratax said in the advisory. "The code will run with the privileges of the target user."
This article originally appeared in SearchSecurity.com.
|
