Internet Explorer zero-day lets hackers steal files from Windows PCs

Page 1 of 2 12 LastLast
  1. Brink's Avatar
    Posts : 38,858
    64-bit Windows 10 Pro build 18898
       #1

    Internet Explorer zero-day lets hackers steal files from Windows PCs


    A security researcher has published today details and proof-of-concept code for an Internet Explorer zero-day that can allow hackers to steal files from Windows systems.The vulnerability resides in the way Internet Explorer processes MHT files. MHT stands for MHTML Web Archive and is the default standard in which all IE browsers save web pages when a user hits the CTRL+S (Save web page) command.

    Modern browsers don't save web pages in MHT format anymore, and use the standard HTML file format; however, many modern browsers still support processing the format.

    AN XXE IN IE 11

    Today, security researcher John Page published details about an (XML eXternal Entity) vulnerability in IE that can be exploited when a user opens an MHT file.

    "This can allow remote attackers to potentially exfiltrate Local files and conduct remote reconnaissance on locally installed

    Program version information," Page said. "Example, a request for 'c:\Python27\NEWS.txt' can return version information for that program."



    Read more: Internet Explorer zero-day lets hackers steal files from Windows PCs | ZDNet

    See also: MSIE XXE 0day


      My ComputersSystem Spec

  2. JGToy's Avatar
    Posts : 363
    Windows 10 Pro x64-bit Build Latest
       #1

    @Brink

    Not a big deal but, after reading your post above I thought, "let's go and turn off IE11" and I did it, saw the warning about turn it off but I kept going...

    Later on I had to use my Quickbooks and '-bang-' there was the problem: Quickbooks won't work without IE11.

    So, I can't turn it off until Intuit find it's way out of Internet Explorer!
      My ComputerSystem Spec

  3. Brink's Avatar
    Posts : 38,858
    64-bit Windows 10 Pro build 18898
    Thread Starter
       #2

    Thank you for sharing your findings @JGToy.
      My ComputersSystem Spec


  4. Posts : 118
    Windows 10 Pro, Version 1903 (build 18362.113)
       #3

    An alternative to turning off IE is to associate MHT/MHTML with a Chromium browser, Word or even Notepad/Wordpad: How to associate .mht and .mhtml files with a Non-Microsoft Store app

    But not Firefox:

    Bree said: View Post
    Which is great - until you actually want to open an MHT file of your own. Firefox can't, in fact it offers to open it for you in IE.
    Apparently Chrome can open .mht/.mhtml files, and now so can the new Chromium-based Edge preview.
      My ComputerSystem Spec

  5.    #4

    Does avoiding the use of IE and not saving web pages or web content avoid the whole issue or should users still either disable IE or associate those files with another program regardless?
      My ComputerSystem Spec


  6. Posts : 118
    Windows 10 Pro, Version 1903 (build 18362.113)
       #5

    Rubi said: View Post
    Does avoiding the use of IE and not saving web pages or web content avoid the whole issue
    No.

    Rubi said: View Post
    or should users still either disable IE or associate those files with another program regardless?
    Yes.

    But the risk is just that if you open a received .htm or .html attachment, they could read a named file which exists in a known folder.
      My ComputerSystem Spec

  7.    #6

    no surprise here with INEPT IGNORER
      My ComputerSystem Spec

  8.    #7

    Wonder how long this flaw has existed with lots of hackers not knowing about it? Well, they know now.
      My ComputerSystem Spec

  9.    #8

    NMI said: View Post
    An alternative to turning off IE is to associate MHT/MHTML with a Chromium browser, Word or even Notepad/Wordpad: How to associate .mht and .mhtml files with a Non-Microsoft Store app
    This did not work for me, it wanted to associate ALL text files with Chrome. Am I missing something?
      My ComputerSystem Spec


  10. Posts : 118
    Windows 10 Pro, Version 1903 (build 18362.113)
       #9

    Rubi said: View Post
    This did not work for me, it wanted to associate ALL text files with Chrome. Am I missing something?
    Yes: Create two text files and rename them to test.mht and test.mhtml
      My ComputerSystem Spec


 
Page 1 of 2 12 LastLast

Related Threads
cant download zip folders it keeps becoming internet explorer icon
Read more: Decade-old Windows kernel bug lets hackers bypass security protections | ZDNet
CCleaner always detects 1-2GB files to be cleaned from IE. I don't use IE, Edge occasionally so what are these files? Are they possibly Windows update files?
Intel chip vulnerability lets hackers easily hijack fleets of PCs | ZDNet
I have a VOIP service that saves every voicemail with the same name. When I opened them with Windows 7 Outlook, a temporary internet file was placed in the folder: "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 14:56.
Find Us