Internet Explorer Download Behavior Vulnerability

A security vulnerability exists in Microsoft® Internet Explorer 5 that could allow a malicious web site operator to read files on the computer of a person who visited the site.

Issue

IE 5 includes a feature called "download behavior" that allows web page authors to download files for use in client-side script. By design, a web site should only be able to download files that reside in its domain; this prevents client-side code from exposing files on the user's machine or local intranet to the web site. However, a server-side redirect can be used to bypass this restriction, thereby enabling a malicious web site operator to read files on the user's machine or the user's local intranet. This vulnerability would chiefly affect workstations that are connected to the Internet.

Affected Products

• Microsoft Internet Explorer 5

Download

Patch: http://www.microsoft.com/msdownload/iebuild/dlbhav/en/dlbhav.htm

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: October 8, 1999

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<