Another IE security flaw this one could lead to data theft
I saw this earlier this afternoon at betanews.com there seems to be a flaw in the way Internet Explorer deals with css that could put your data at risk. According to this article it is a risk combined with Google Desktop. This can be “fixed” by disabling scripting or using Firefox as your primary browser. Currently Microsoft says it is “investigating the problem”…
The securityfix has coverage this afternoon.
Microsoft said in a statement that it was investigating the problem, saying the exploit detailed by Gillon “could potentially allow an attacker to access content in a separate website if that website is in a specific configuration.” The company said it was not aware of any “active attacks or of customer impact,” and said it may issue a security advisory on the matter or provide an update through its monthly patch release process to fix the problem.
It doesn’t sound as though it’s a flaw with Google Desktop in spite of the fact that is the means through which this was discovered.
Israeli hacker Matan Gillon says he’s discovered that an unpatched security hole in IE could allow a Web site to see files on the visitor’s computer that store data about the user’s relationship with other Web sites.
In a detailed analysis published on his Web site, Gillon demonstrates how the hack could be leveraged to steal data on the victim’s machine indexed by Google Desktop Search, a free program that allows users to quickly find a variety of files on their computers. The problem is not with Google’s software, which contains several built-in security measures to ensure that data cached by its software cannot be read by anyone other than the user.
Full details can be found at the resaearchers site.
The Microsoft security advisory is available here.