Microsoft haunted by old IE security flaw
Browser vulnerability--patched six years ago--resurfaces in newer releases. It could let hackers change content on Web sites.
Security company Secunia issued a bulletin warning of the flaw in versions 5.01, 5.5 and 6.0 of Internet Explorer (IE). The problem had been fixed six years ago, when it appeared in versions 3.0 and 4.0 of the IE browser.
"It's a concern that a company like Microsoft has a problem that's already been fixed in older versions resurface in newer ones," said Thomas Kristensen, chief technology officer of Secunia.
Microsoft has been plagued by a recent spate of IE vulnerabilities. The latest attack was reported Tuesday. Through a flaw in IE, victims can pick up a program through a pop-up ad that is used to read keystrokes and steal passwords when people visit any of nearly 50 banking sites.
Vulnerabilities in IE have become so common that some security researchers are recommending that people adopt alternate browsers. The U.S. Computer Emergency Response Team, the official U.S. body responsible for defending against online threats, also advised security administrators to consider moving to a non-Microsoft browser among six possible responses.
According to the latest bulletin, the vulnerability affects people who have multiple IE browsers open. Through one of the open browsers, hackers can change the content of another Web site without users ever knowing that it has been altered.
Using this attack method, hackers could insert links into legitimate Web pages and direct people to malicious sites where they could solicit personal information such as bank account or credit card information. Because the link comes from a legitimate and trusted site, victims may not realize they have been redirected to a harmful site. Hackers could also insert links that would trick users into downloading malicious software.
"It's a major problem when people can't trust what they are seeing in their browser," Kristensen said.
Another flaw discovered last week turns some Web sites into points of digital infection. The vulnerability was nipped in the bud on Friday, when Internet engineers shut down a server in Russia that had been the source of the malicious code.
Another flaw, discovered earlier this month, installed a toolbar on victims' computers that triggered pop-ups.
CNET News.com's Robert Lemos contributed to this report.