Internet Explorer - множественные критические уязвимости

[lakostis]

Привет!

Ну вот опять :) Мне кажется, пока IE переименовывать в "интернет глюкалку", уже который раз по одним и тем же граблям ходют:

(1) HIGH: Internet Explorer Multiple Vulnerabilities
Affected: IE 6.0 and 6.0 SP1

Description: Fully patched versions of Internet Explorer reportedly
contain the following vulnerabilities that are being exploited in the
wild to compromise client systems. (a) Internet Explorer successfully
processes a webserver response that redirects the location of a resource
to a file on the client system. Note that this file can be accessed in
the security context of the "Local Computer Zone". (b) Internet Explorer
contains a cross-domain vulnerability that can be triggered when
handling a frame, and a "modal dialog box" that is invoked from the
frame. These vulnerabilities can be exploited by a malicious website to
execute arbitrary code on a client system. The technical details and the
exploits have been publicly posted.

Status: Microsoft not confirmed, no patches available.

Analysis by Jelmer
http://62.131.86.111/analysis.htm