Security
Another URL-Handling Bug Hits IE
Microsoft is warning of yet another URL-handling bug that can lead to a system hijack.
A mere two days after Patch Tuesday brought a host of remote-code execution vulnerabilities to light, Microsoft issued a security advisory warning of yet another problem: a URL-handling vulnerability that could lead to systems getting hijacked if running Internet Explorer 7 on Windows XP or Windows 2003.
Full Disclosure security mailing list recipients have been wrangling over who’s at fault with that bug. The list of applications affected by the bug includes Skype, Adobe Systems’ Acrobat Reader, the Netscape browser, Miranda Instant Messenger and the Firefox browser.
The protocol handler flaw involves the launch of arbitrary programs when special URLs containing the % character are clicked on. In doing so, the launched programs may allow spyware to be installed on the user’s system. The developers of Mozilla have temporarily remedied a similar problem in Firefox in 2.0.6.
Security researcher Juergen Schmidt, with Heise Security, detailed on the Full Disclosure mailing list Oct. 5 how IE 7 passes invalid URIs to Windows XP. In doing so, he also noted that Microsoft had dismissed the vulnerability and said that after a “thorough investigation,” Microsoft had determined that it wasn’t a vulnerability in a Microsoft product.
