Don't Cross The IE Cross Domain Scripting Vulnerability

Nothing is ever perfect and even the best stuff in this world is prone to errors and vulnerabilities. The perfect product does not exist, and this concept is also applicable to the world of computer security. The latest news is that the widely used Microsoft Internet Explorer has a computer security vulnerability. This weakness runs the risk of being exploited and the execution of malicious code occurring - this is directly related to the browser security zone or alternatively to an arbitrary domain.

This vulnerability, known as the IE Web Folder Behaviors Cross-Domain Scripting Vulnerability, is caused due to a security error that exists within the browser security model, when the handling of URLS takes place. This happens when a web folder view is rendered. Some of the files of Internet Explorer 6 may include but are not limited to the following:A2P.EXE, B-TEST.EXE, C2PH.BAT, CabInst.exe as well as creatfil.exe.

This vulnerability can be exploited in order to access an unknown domain. This may result in script code that is attached to a malicious page, actually accessing properties of a different site. The malicious characters could then do whatever they please, with the inclusion of stealing confidential information from chosen victims.

This is not the only risk that exists. This vulnerability could be exploited in order to execute arbitrary code. This may be achieved by running malicious code in a browsers security zone which has decreased security settings (e:g Local computer, trusted Sites and intranet zones). The code execution would take place within the context of the user that is logged in at that particular point in time.

You may be wondering what the solution to this vulnerability actually is? If I were you I would be wondering too. The solution to this vulnerability is for users to apply the relevant updates from Microsoft. Microsoft has applied updates to the security bulletin for this vulnerability, in order to accurately reflect the availability and effectiveness of updated fixes.