Microsoft Corp. on Monday finally released a patch for a dangerous vulnerability that lets attackers trick Internet users into visiting malicious sites. The flaw has been public knowledge for some time, but Microsoft failed to include a fix for it with Januarys scheduled patch releases.
The vulnerability has to do with the way IE parses URLs, specifically those that contain special characters. Using this weakness, an attacker can create a link that looks like it will send a user to a legitimate site, such as www.eweek.com. However, once the user clicks on the link, the attacker can cause content from another site to appear in the window.
Microsoft typically releases security fixes on the second Tuesday of each month. But the seriousness of this vulnerability caused the company to publish this patch out of cycle.
The company also released patches for two other flaws in IE Monday. One of the vulnerability is in the cross-domain security model in IE, which is supposed to keep windows in different domains from sharing data. But this weakness allows an attacker to run scripts on remote machines if he can force the user to visit a malicious Web site or open an HTML e-mail message.
The other weakness involves dynamic HTML operations and allows an attacker to save a file on a target users machine. The file would not execute automatically.