Holes found in Microsoft browser client context tool

The firm said the holes, discovered by Nicolas Gregoire, allow wicked people to conduct cross site scripting attacks or to compromise vulnerable systems.

The first hole means that invalid input passed to ISAPI extension is not "sanitised" properly before being returned as error messages. This can mean people can execute arbitrary HTML and script code in a browser session at a vulnerable web site.

The second hole consists of input passed in HTTP headers not being properly cleaned up either, allowing similar shenanigans to happen.

Thirdly, a boundary error when processing parameters can be exploited to create a buffer overflow by passing a heck of a long parameter, such as http://[host]/scripts/w3who.dll?AAAAAAAAA...[519 to 12571]....AAAAAAAAAAAAA

The solution is to remove the 23who.dll ISAPI extension, Secunia said. µ