MSN Messenger Vulnerable to Hijacking

A well-known problem in the way that Internet Explorer handles user cookies can be exploited to allow an attacker to hijack MSN Messenger sessions, according to a bulletin published by a U.K. security researcher.

The vulnerability, which another researcher brought to the attention of Microsoft Corp. late last year, is in the document.open command and allows attackers to view users cookies and read files on vulnerable machines.

An MSN Messenger user who is using a vulnerable version of IE would be vulnerable to similar attacks which would give an attacker the ability to see the users MSN contact list, send spoofed messages to those contacts and grab files off the local drives.

Microsoft issued a patch for the IE vulnerability on Saturday. But its not the first such problem to arise in the Redmond, Wash., software companys instant messaging client.

Last week, Richard Burton, another security researcher, warned that a feature in Messenger that allow Web sites with JavaScript to access Messenger users contact lists and, in some cases, those contacts e-mail addresses.

The issue is considered a privacy risk and not a security vulnerability as the feature that enables the activity was deliberately included in the Messenger client.

For more security coverage go to Security under Hot Sections.