Text handling flaw found in Internet Explorer

By Matt Whipp

Posted on 23 Mar 2006 at 11:26

Another bug has been found in IE's dirty linen, and once again it's being washed in public.

On Microsoft's Security Response Center blog, lead security program manager Lennart Wistrand said that the company was aware of information that had been made public about a possible flaw that would allow code to be run if the user visited a specially built page.

The bug comes just days after a similarly public flaw was discovered that could cause the browser to crash.

This latest vulnerability, however, is more serious in scope. It exists in the createTextRange() component which is used to examine and modify the text within an HTML element and was first introduced to the browser in IE 4.0.

Wistrand says that the security team has confirmed the existence of the vulnerability and that he is writing an advisory.

He suggests a workaround of turning off Active Scripting - a successful attack would require scripting to be enabled.

Users of the Beta 2 Preview for IE7 are not affected. Nor does the flaw affect users of Outlook and Outlook Express that are still supported as the restricted zone mail policy will prevent such an attack from successfully running.

Wistrand also adds that sticking strictly to trusted sites is a good safety habit for avoiding attacks of this nature.