We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,059 News Articles

Microsoft: IE flaw opens your PC to hackers

Use Protected Mode, Internet Explorer users warned

Microsoft warned yesterday that a flaw in Internet Explorer gives attackers access to files stored on a PC.

Microsoft said that the flaw in its Internet Explorer web browser gives attackers access to files stored on a PC only under certain conditions, however.

"Our investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location," Microsoft said in a security advisory.

The vulnerability requires that an attacker knows the name of the file they want to access, it said.

The disclosure is the latest security problem to affect IE. Last month, an undisclosed vulnerability in IE 6 was used in attacks that targeted more than 20 US companies, including Google, which blamed China. The vulnerability has since been fixed by Microsoft.

The attacks led Google to announce last week that it would phase out support for IE 6, starting with Google Apps and Google Sites in March. (See: Google and DoH drop support for IE6.)

The IE vulnerability disclosed on Wednesday, which is caused by incorrectly rendering local files in the browser, affects several versions, including Internet Explorer 5.01 and IE 6 on Windows 2000; IE 6 on Windows 2000 Service Pack 4; and IE6, IE 7, and IE 8 on Windows XP and Windows Server 2003, Microsoft said.

"Protected Mode prevents exploitation of this vulnerability and is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008," it said.

Microsoft hasn't seen any attacks that exploit the flaw and has yet to decide whether to repair the flaw through its monthly security patch release cycle or an urgent, out-of-cycle update.

Related articles:



IDG UK Sites

How to watch Samsung Galaxy Note 4 launch live: Unpacked 2014 Episode 2 at IFA

IDG UK Sites

How Apple, Adobe, Microsoft and others have let us down over UltraHD and hiDPI screens

IDG UK Sites

Miranda July's Somebody app offers a very unusual take on messaging

IDG UK Sites

What to expect from Apple in autumn/winter 2014: iPhone 6, iPhone Air, iWatch, iPad 6, new Apple...