Redmond investigating new IE flaw

IE users only have to be concerned with websites designed to exploit the flaw, said Lennart Wistrand in a posting on Microsoft's Security Response Center weblog.

"You may have heard about an IE crashing vulnerability that was unfortunately publicly posted before the weekend. We just wanted to make a quick note here that, as always, we're investigating it," he said. "So far we've determined that visiting a page that exploits it could cause IE to fail. We're going to continue to look into this, but remind you that safe browsing practices can help here, like only visiting trusted websites, etc."

Security researcher Michal Zalewski exposed the vulnerability in a security emailing list last week.

"This vulnerability can be triggered by specifying more than a couple thousand script action handlers (such as onLoad, onMouseMove, etc) for any single HTML tag," he said. "Due to a programming error, MSIE will then attempt to write memory array out of bounds, at an offset corresponding to the ID of the script action handler multiplied by 4 (due to 32-bit address clipping, the result is a small positive integer)."

Secunia gave the flaw a low ranking, "not critical," and advised PC users not to visit untrusted websites.

"The vulnerability is caused due to an array boundary error in the handling of HTML tags with multiple event handlers," the vulnerability monitoring firm said on Monday. "The weakness has been confirmed on a fully patched system with Internet Explorer and Microsoft Windows XP Service Pack 2."