Drag-and-drop flaw mars Microsoft's latest update

An independent researcher finds an Internet Explorer vulnerability that could turn drag-and-drop into drag-and-infect.

For more on Service Pack 2, visit our SP2 Resource Center.

By Robert Lemos
Staff Writer, CNET

An independent researcher warned that an Internet Explorer vulnerability could turn drag-and-drop into drag-and-infect, even on computers updated with Microsoft's latest security patch.

The flaw affects the latest version of Internet Explorer running on Windows XP, even after the latest major update—known as Service Pack 2—is applied. An attacker using the flaw could install a program on a victim's computer after convincing the person to visit a malicious Web site and click on a graphic.

The attacker's program would be placed in the Windows startup folder and would run the next time the user restarted the computer. The security researcher who discovered the flaw, known by the online nickname "http-equiv," posted an example to show the power of the flaw.

"If you look at the Web page, all you see are two red lines and an image, drag the image across the two lines and drop it," he said. "What you have actually done is drop (a program) into your startup folder. Next time you switch the computer on it runs the program."

Security information company Secunia believes the program that takes advantage of the issue could be simplified to only require a single click from the user. Secunia its second-highest rating of vulnerability threats.

Microsoft did not immediately comment on the issue.

Security researchers in Windows XP Service Pack 2, or SP2. The drag-and-drop flaw is perhaps the most serious found to date in computers that have been patched with Microsoft's major security update.

Service Pack 2 promises to add better security to Windows XP's handling of network data, program memory, browsing activity and e-mail messages, by changing the system's code and configuration. A revamped firewall, for example, attempts to prevent malicious applications on a PC from connecting to the Internet by requiring that the user give specific permission for each attempt.

The SP2 software, which took almost a year to develop, is seen by many on Aug. 11, 2003. Almost 26 days before, Microsoft had issued a patch for the security hole exploited by the worm. However, many people did not install the fix, even though there was widespread expectation that a virus would be created to take advantage of the flaw.

Ironically, this time around, most people have not had a chance to update their computers with the security patch. The update became available only on Wednesday and will who wants the software, Microsoft said.

Even so, security researcher "http-equiv" believes that the software giant's latest patch does its job.

"The patch really does lock down the machine nicely, and whatever anyone finds now will be completely different to the previous year's findings," he said.

Editor's Picks

Free Newsletters, In your Inbox