Unpatched IE Flaw Is Worse Than Expected

Unpatched IE Flaw Is Worse Than Expected: "By Larry Loeb
November 28, 2005
Last week was shortened by the Thanksgiving holiday, and it seemed the malware guys took it off as well. There was not much going on of recent origin, and the biggest blip on the security radar was the realization by the security community that an Internet Explorer problem first identified six months ago was a lot worse than it appeared.

The realization caused Secunia to issue a rare 'Extremely Critical' advisory. Once thought just to be a DoS vulnerability, it turns out that it also allows execution of arbitrary code.

Benjamin Tobias Franz figured out the original problem in March of this year, which can be summarized thusly: IE fails to correctly initialize the JavaScript 'Window()' function, when used in conjunction with a event. This means that Internet Explorer encounters an exception when trying to call a dereferenced 32-bit address located in ECX."