Microsoft IE holes can give attackers complete control: McAfee

Stan Beer
Wednesday, 12 April 2006 13:34

Business IT - Security

Security vendor McAfee believes the latest Windows vulnerabilities announced by Microsoft are so serious that users could lose complete control of their workstations to attackers.
Today's bulletins cover a total of 15 vulnerabilities -- 10 vulnerabilities affecting Microsoft Internet Explorer, two vulnerabilities in Microsoft Windows Explorer and one vulnerability in Microsoft Outlook Express, MDAC and Microsoft FrontPage. An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of the client workstation, according to McAfee. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

"Among the Microsoft vulnerabilities announced today, two out of the ten Internet Explorer vulnerabilities have already been exploited and four more were previously disclosed," said Monty Ijzerman, senior manager of the Global Threat Group for McAfee AVERT Labs.  "While there is the potential for further exploits targeting the Internet Explorer vulnerabilities, the vulnerability in the Microsoft Data Access Components (MDAC) also poses a serious concern.  It can be exploited with minimal social engineering, requiring no user interaction other than simply visiting a malicious Web site."