GFI, leading developer of email content checking and network security software, has discovered a security flaw in Internet Explorer and Microsoft Access 2000 that allows macros to be executed automatically on a victim's machine. GFI has notified Microsoft Corp., which issued an advisory (Microsoft Security Bulletin number MS02-005, dated 11 February 2002). This flaw within Internet Explorer allows a malicious user to run arbitrary code on a target machine as it attempts to view a website or an HTML email. It can be exploited by embedding macro code such as VBA (Visual Basic for Applications) within an Access database file (.mdb) that in turn lies within an Outlook Express email file or Multipart HTML File (.mhtml). If this file is accessed using Internet Explorer, the attachment can be automatically executed without triggering any warnings.
|