Drag-and-drop Flaw in Internet Explorer Reported

Iria · Feb 14, 2006, 03:57 PM

LONDON -- Security analysts and vendors are reporting a flaw in Microsoft's Internet Explorer browser that could allow malicious code to run and result in a hacker taking over complete control of a computer.

Microsoft was informed of a vulnerability with Explorer's drag-and-drop function in August 2005 after it was first found by Matthew Murphy, according to Noam Rathaus, chief technical officer for Beyond Security in Netanya, Israel, said today. The company, which helped Murphy report the flaw to Microsoft last year, runs an independent security site called SecuriTeam.

Websense, which also issued a warning Monday, wrote that a specially crafted Web site could trick a user into dragging and dropping an item from one window to the other. After the user released the mouse in the newly focused window, code could run without consent, Websense said.
__________
Read More / Source: PC World

Feb 14, 2006, 03:57 PM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	Drag-and-drop Flaw in Internet Explorer Reported LONDON -- Security analysts and vendors are reporting a flaw in Microsoft's Internet Explorer browser that could allow malicious code to run and result in a hacker taking over complete control of a computer. Microsoft was informed of a vulnerability with Explorer's drag-and-drop function in August 2005 after it was first found by Matthew Murphy, according to Noam Rathaus, chief technical officer for Beyond Security in Netanya, Israel, said today. The company, which helped Murphy report the flaw to Microsoft last year, runs an independent security site called SecuriTeam. Websense, which also issued a warning Monday, wrote that a specially crafted Web site could trick a user into dragging and dropping an item from one window to the other. After the user released the mouse in the newly focused window, code could run without consent, Websense said. __________ Read More / Source: PC World