New Internet Explorer holes causing alarm

The four flaws could allow hackers to run attack code on Windows systems

Four new holes have been discovered in the Internet Explorer Web browser that could allow malicious hackers to run attack code on Windows systems, even if those systems have installed the latest software patches from Microsoft Corp., security experts warned.

Some of the flaws are already being used to attack Windows users and include a glitch that allows attackers to fake or "spoof" the address of a Web page, as well as vulnerabilities that enable malicious pages from the Internet to be handled by Internet Explorer with very little scrutiny or security precautions.

A Microsoft spokeswoman acknowledged the reports and said the software company is looking into the attacks and is considering what steps to take, including the release of an emergency security patch to address the problems.

Word of the four vulnerabilities surfaced in security discussion newsgroups in recent weeks. Two of the vulnerabilities, allows attackers to load content from malicious Web pages while displaying the Web address of legitimate sites in the Web browser's address bar. Attackers could trick users into clicking on the bogus Web links using e-mail messages or by linking from other Web pages.

The vulnerability is very similar to another hole uncovered in December that allowed attackers to hide the real location of a Web page by including the characters %01 before the @ symbol in a URL. The new vulnerability allows attackers to hide the actual address of the Web page that's being loaded by prefacing the address with the characters ::/ with some Internet Explorer Web site addresses, according to security company Secunia.

"Conceptually, it's very similar to the %01 problem, and [the flaw] is in a related part of the Internet Explorer code," said Thor Larholm, senior security researcher at PivX Solutions LLC.

Another unpatched hole, called a "cross-zone scripting" vulnerability, allows attackers to trick Internet Explorer into loading insecure content using relaxed security precautions typically applied to files stored on the local hard drive or obtained from any trusted Web site