DHTML Edit Vulnerability

A vulnerability exists in an ActiveX control that is distributed in Internet Explorer 5 and downloadable for Internet Explorer 4.0. The vulnerability could allow a malicious web site operator to read information that a user had loaded into the control, and it also could allow files with known names to be copied from the user's local hard drive.

Issue

The DHTML Edit control is an ActiveX control that is distributed with Internet Explorer 5 and can be downloaded for use in Internet Explorer 4.0. The control enables users to edit HTML text and see a faithful rendition of how the text would look in the browser. There are two versions of the control: a more powerful version that cannot be invoked by a web site because it includes file access and other features, and a "safe for scripting" version that has restricted functionality and is intended for use by web sites.

The root cause of the vulnerability lies in the fact that a web site that hosts the "safe for scripting" version of the control is able to upload any data entered into the control. A malicious web site operator could trick a user into entering sensitive data into a DHTML Edit control hosted on a web page from the operator's site, and then upload the data. In addition, if the malicious web site operator knows the name of a file on the user's local drive, it is possible for the operator to programmatically load the file into the control and then upload it.

Affected Products

• Internet Explorer 4 and 5 on Windows 95, Windows 98, and Windows NT 4.0

Download

Patch: http://www.microsoft.com/windows/ie/security/dhtml_edit.asp

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: April 21, 1999

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<