Latest SP2 Flaw Bypasses IE Security Zone

Security researchers have discovered another vulnerability in Windows XP Service Pack 2, but it doesnt appear to be an immediate threat.

The researcher who uncovered the drag-and-drop flaw in Windows XP SP2 earlier in the week has reported that a new vulnerability exposes a hole in the lockdown of Internet Explorers My Computer security zone.

The lockdown of the My Computer zone is one of the major security enhancements in SP2. Web pages in Internet Explorer run in one of several security "zones," each of which has different security rules. Prior to SP2, the My Computer zone—designed for Web pages stored on the computer itself—had extremely permissive rules. In order to take advantage of them, malware attacks frequently exploited vulnerabilities to get their Web-based pages to execute. Microsoft tightened the rules in SP2 to make it a less inviting target.

In the new attack, the use of an unconventional value in the "Content-Location:" field of an MHTML (MIME HTML) file causes the browser to execute the file in the Local Intranet zone, even though it is run from the local computer. This allows scripting operations that are not permitted in the local zone. MHTML files are a variant HTML format in which accessory files, such as images, can be stored as part of the file itself.

While this example does demonstrate a weakness in the local computer lockdown by Service Pack 2, the technique doesnt work in a standard HTML file delivered in a browser. Because the file must be downloaded by the user and executed locally, it is much harder to deliver to the user. It is, in a sense, no different from a threatening .exe file. It is possible that it could be blended in the future with other exploits of SP2 to create a true remote attack.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Be sure to add our eWEEK.com developer and Web services news feed to your RSS newsreader or My Yahoo page