Microsoft slammed over latest IE flaw

Experts have warned that Microsoft's avoidance of a known security rule has resulted in a severe flaw in the Internet Explorer (IE) browser.

Discovered just before Christmas, the vulnerability could allow malicious users to spoof legitimate websites, steal data from cookies or access files on a victim's machine.

According to security site SecurityFocus and an independent researcher who discovered the bug going by the name of 'ThePull', Microsoft has neglected to stick to a security rule known as the 'same origin policy'.

Developed as part of a JavaScript security guide written by Netscape engineers and cited by the Computer Emergency Response Team in an advisory, the 'same origin policy' is designed to prevent code from one site affecting another site opened in a different window.

When using the 'document.open' command in JavaScript, IE allows code from the 'parent' window to interact with the properties of a 'child' window.

This would allow an attacker to set up a specially constructed website capable of stealing information from a viewer's cookie files, such as user IDs or credit card numbers, or trick users into believing that they are visiting a trusted, legitimate site.

"This violation of the 'same origin policy' is a severe security vulnerability. There are many ways that an attacker could exploit this vulnerability," said SecurityFocus in an advisory.

ThePull has put up demonstration code on his website to back up his claims.

According to the researcher, Microsoft is aware of the problem and will be releasing a patch in the near future. Until then, users can boost their security by disabling active scripting in their browsers.