<h2>Exploit Code Out for IE Flaw</h2>
Security experts have warned of the existence of exploit code for a
new flaw in Internet Explorer, that can leave systems open to remote
attack.
Security researcher - Secunia, said in its advisory, that the exploit
code aims at taking advantage of the "extremely critical"
vulnerabilities in IE 5.5 and IE 6 running on XP Service Pack 2 (SP2),
as also in IE 6 running on Windows 2000 SP4.
The exploit code was published by an organization called "Computer
Terrorism".
In the event a user is tricked into visiting a malicious Web site, the
exploit triggers off automatically without the user having to do
anything. The attacker can use the exploit to run any code on a user's
system.
Reportedly the vulnerability lies in a Javascript component of IE,
which is used to load Web pages onto a PC. The IE vulnerability has
been known for the past six months, but was earlier viewed as a
problem for denial-of-service attacks rather than remote execution of
code.
Microsoft never issued a patch for the flaw, since it was initially
believed to involve only a potential DOS attack.
Security experts say that as of now users can work around the problem, either by shutting off Javascript or using another type of browser.
A Microsoft representative said that the company is investigating the
matter, and upon completion of investigation will issue a patch either
as part of its monthly security bulletin, or in the form of a separate
security advisory.<font size="1" color="#8e236b"><p align="center">[This message was edited by Wiz Feinberg on 24 November 2005 at 08:41 AM.]</p></FONT>
