VULHUB ™

Microsoft Security Bulletin MS04-038 includes fixes to address an unspecified vulnerability in Internet Explorer that may permit elevation of zone privileges by bypassing from the Internet Zone to the Local Zone. The vendor has stated that additional security verifications have been added to prevent the showHelp DHTML method from being abused by a malicious Web site to load HTML Help files in the context of the Local Zone. It is unclear at this point whether they mean HTML Help files that already exist on the system or HTML Help files that originate from a remote source. Although unconfirmed, this could be related to the following unspecified vulnerability that was addressed in Windows XP SP2/BID 10897 ( Microsoft Windows XP SP2 Released - Multiple Vulnerabilities Fixed): - HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method This is likely similar to earlier issues that have been reported in showHelp, such as BID 9320. Microsoft has not...

Microsoft Security Bulletin MS04-038 includes fixes to address an unspecified vulnerability in Internet Explorer that may permit elevation of zone privileges by bypassing from the Internet Zone to the Local Zone. The vendor has stated that additional security verifications have been added to prevent the showHelp DHTML method from being abused by a malicious Web site to load HTML Help files in the context of the Local Zone. It is unclear at this point whether they mean HTML Help files that already exist on the system or HTML Help files that originate from a remote source. Although unconfirmed, this could be related to the following unspecified vulnerability that was addressed in Windows XP SP2/BID 10897 ( Microsoft Windows XP SP2 Released - Multiple Vulnerabilities Fixed): - HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method This is likely similar to earlier issues that have been reported in showHelp, such as BID 9320. Microsoft has not released further details about this vulnerability.