In Internet Explorer, a flaw exists in the way VBScripts -- pieces of code that can be embedded into Web pages -- in one browser frame can access the content of other browser frames. An attacker could create a Web page or HTML email that would let him either read files from the user's local drive, or read information from pages subsequently visited by the user. The second scenario could mean, for example, that the attacker could read credit card numbers and passwords typed by the user into third-party Web sites. The attacker could only read local files that can be displayed in a browser, such as text or HTML files, and would have to know the exact path to the file in order to read it. However, system files in Windows are often stored in default locations. The vulnerability arises because of a problem with the way IE handles security for VBScripts attempting to read data from another browser frame that originates from a different domain. Scripts normally shouldn't be allowed to do this, but the flaw allows them to do so. The bug affects IE versions 5.01 SP2, 5.5 SP1, 5.5 SP2 and 6.0. The IE patch is here, and is also available through Windows Update. The XML Core Services bug
XML Core Services 2.6 and later -- shipped with Internet Explorer 6.0, SQL Server 2000 and all copies of Windows XP -- contains a similar bug that could let a hacker read data from the user's computer. The flaw occurs in an ActiveX control called XMLHTTP, which allows Web pages in the browser to send and receive XML data via HTTP, the standard Web transfer protocol. XML is an Internet language for describing just about any sort of data. XMLHTTP doesn't properly check the security settings for some types of data requests in a Web page, allowing them, if properly disguised, to request data from the user's hard drive. An attacker could fashion a Web page to secretly read files from the user's computer, but would first have to cause the user to visit the page. The attack couldn't be carried out in an HTML email. As with the IE bug, the attacker would have to know the full path name to the file he or she wanted to read. The patch is available here, or through Windows Update. Commerce Server open to attacks
The Commerce Server 2000 glitch is different, allowing attackers to launch what's known as a Denial of Service (DoS) attack, crashing the server, or to run the code of his choice on the server. Commerce Server is based on Microsoft's Internet Information Services server, but IIS itself isn't vulnerable. The fault occurs with a default Commerce Server file called AuthFilter, which handles some authentication procedures. An attacker could send authentication data that overran an unchecked buffer in AuthFilter, causing the AuthFilter process to fail or causing it to run code of the attacker's choice. The process in question runs with advanced privileges, which would give the attacker complete control of the server. In some cases the attacker could extend his control of the compromised server onto other computers on the network, depending on the security access given to the Commerce Server, according to Microsoft. A patch for the bug is available here, and will be included with Commerce Server 2000 Service Pack 3, Microsoft said. SQL Server denial-of-service risk
Finally, SQL Server includes a similar unchecked buffer glitch that leaves it open to DoS attacks. SQL Server 7.0 and 2000 include an unchecked buffer in a function designed to let the server create an "ad hoc" connection to remote data sources. A hacker could create a buffer overflow by sending a specially formed database query through a Web site, or by attempting to load and execute a query. The buffer overflow would crash the server, or give the attacker the ability to run code with the same system privileges as the server. The exploit wouldn't always be available, however, depending on the way the server is configured. The patch for SQL Server 2000 is here, and the patch for SQL Server 7.0 is here. The security alerts were all released late last week.
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section.
Have your say instantly, and see what others have said. Go to the Security forum.
Let the editors know what you think in the Mailroom.
