Zero-Day Internet Explorer Vulnerability Published

The potential exploit relates to the Microsoft Web browser's "Print Table of Links" feature.

Thomas Claburn, Editor at Large, Enterprise Mobility

May 15, 2008

2 Min Read

Israeli security researcher Aviv Raff on Wednesday published details about a zero-day vulnerability in Microsoft Internet Explorer.

Last week, Raff held a "treasure hunt" on his site, where he had hidden the exploit code. He declared "George the Greek" the contest winner in conjunction with the publication of details about the vulnerability.

"Internet Explorer is prone to a Cross-Zone Scripting vulnerability in its 'Print Table of Links' feature," Raff explained in a post on summarizing his proof-of-concept exploit. "This feature allows users to add to a printed Web page an appendix which contains a table of all the links in that Web page."

According to Raff, an attacker can add a maliciously crafted link to any Web page that accepts user generated content that, under certain circumstances, lets the attacker take control of the user's machine when he or she tries to print the page.

When it prints a page, Internet Explorer invokes a local resource script to generate any of the HTML to be printed. "This HTML consists of the following elements: Header, webpage body, footer, and if enabled, also the table of links in the Web page," Raff explains.

Because the script does not validate the URL, an attacker can inject a script that will be executed when the HTML to be printed is generated.

Users of Internet Explorer 7.0 and 8.0b on fully patched Windows XP systems are vulnerable. Users of Windows Vista with User Account Control (UAC) enabled may only be subject to information leakage. Earlier versions of Internet Explorer may also be affected.

Raff said that he alerted Microsoft to the problem on Tuesday and that the company is planning a fix. In the meantime, he advises not using the "Print Table of Links" feature when printing Web pages.

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights