New Internet Explorer Vulnerability Revealed by Microsoft   2/8/2006 - 863 views,

According to Microsoft, the vulnerability can be exploited in one of four different ways, involving any one of WMF images, email attachments, link poisoning, or getting a user to view an email message in the Outlook Express preview pane.

Explained Microsoft, “Microsoft has determined that an attacker who exploits this vulnerability would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker’s Web site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems. In an e-mail based attack, customers would have to click a link to the malicious Web site, preview a malicious e-mail message, or open an attachment that exploited the vulnerability. In both Web-based and e-mail based attacks, the code would execute in the security context of the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.�

That’s the bad news.

The good news is that this vulnerability affects only Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium. And no others.

So if you are running either of these, gosh, time to upgrade!