IE has flaw of doom

A UK group of hackers has published a zero-day exploit which puts means IE users only have to visit a site to be attacked.

Computer Terrorism's exploit allows a remote hacker to take complete control of a Windows system.

To prove Computer Terrorism's system worked, it posted a proof-of-concept exploit, available here, which launches the Windows Calculator.

The flaw is based on a Javascript Window() vulnerability which Microsoft has known about for several months. However Vole has been mistakenly treating it as a low-priority denial-of-service flaw, a spokesComputer Terrorist said.

The exploit works on fully patched Windows XP systems with default IE installations and could be good-night Vienna to anyone using the Microsoft browser.

Microsoft admitted that customers running Windows 2000 SP4 and Windows XP SP2 were at risk. However Windows Server 2003 and Windows Server 2003 SP1 in their default configurations, with the Enhanced Security Configuration turned on, are safe.

It doesn't work on Firefox browsers and some pundits are suggesting moving over to the open sauce browser until IE is fixed. µ