According to the US Computer Emergency Response Team (US-CERT), the vulnerability lies in the way IE 6 handles attempted cross-site scripting attacks. When code is embedded within a specially crafted HTML document, the security protections will not function properly, and the user is open to attack.
If successfully executed, US-Cert believes that an attacker could execute a cross-domain scripting attack in which the attacker could steal such things as cookies and security credentials without any warning to the user.
According to McAfee researcher Yichong Lin, the vulnerability was first disclosed in a Chinese security publication known as 'pstzine.' Lin noted that a similar concept, known as "Ghost Pages" has previously been discussed by researchers.
While there is no fix for the vulnerability currently available, both Firefox and Internet Explorer 7 are protected from the attack. Both McAfee and US-Cert recommend that IE 6 users upgrade to the latest version of the browser to avoid infection.
Users who do not wish to upgrade are advised by both companies to disable scripting.
Watchdogs warn of IE 6 flaw
By
Shaun Nichols
on Jun 27, 2008 1:34PM
Security experts are warning of a new security vulnerability in Internet Explorer 6..
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
Promoted Content
How Australian governments can accelerate their cloud-first IT strategies
Promoted Content
Albemarle cuts e-waste, capex spend "substantially" by hiring rather than buying
Promoted Content
Why IT spending should be transformational, not just transactional
Promoted Content
Kick the tyres of AI systems using real world data at #BuildWithAI Hack 2021
Sponsored Whitepapers
The CISO View 2021 Survey: Zero Trust and Privileged Access
How and why to backup your Office 365 tenant
ForgeRock for Australia’s Trusted Digital Identity Framework (TDIF)
How engineering has been operating in the dark and what to do about it
The Top Six Digital Transformation Trends Shaping Business and Society
