Microsoft admits new IE flaw

Microsoft has admitted it is investigating another flaw in its Internet Explorer browser.

The new flaw affects all versions of the browser, but only if they're running in the XP operating system or have disabled Internet Explorer Protected Mode - which is the default mode for the browser in Vista and later operating systems.

The flaw allows access to users' data, but attackers would only be able to access the hard drive if they know the exact location and name of a file.

"Customers running Internet Explorer 7 or Internet Explorer 8 in their default configuration on Windows Vista or later operating systems are not vulnerable to this issue as they benefit from Internet Explorer Protected Mode, which protects from this issue," noted senior security communications manager Jerry Bryant on the Microsoft Security Response Centre blog.

"Windows XP users, or users who have disabled Protected Mode, can help protect themselves by implementing Network Protocol Lockdown," he added, which can be installed for individuals or enterprises using an automated Microsoft Fix It available here.

The hole was publicly reported, but Microsoft said it was "unaware of any attacks attempting to use this vulnerability." Microsoft added that it would issue a patch either through it's monthly patching cycle - due next week - or via an out of band patch, as it did with the last IE6 flaw.

The news comes as a petition has asked the UK government to urge users to upgrade from IE6 to a newer version - or another browser - after a series of security flaws have come to light in the Microsoft browser.

Email to a friend

Print this page