Web based attacks are one of the most common forms of attack initiated by the criminals. Attackers exploit vulnerabilities on websites, web browsers and other web applications. Recently, Microsoft has alerted users on a critical vulnerability in Internet Explorer that could allow an attacker to execute malicious scripts. Attackers may exploit the vulnerability and compromise information security. The vulnerability is associated with the handling of Multipurpose Internet Mail Extensions (MIME) formatted requests by MIME HTML (MHTML). The vulnerability may in some instances cause an Internet user to execute a malicious script on visiting a malicious web page. MIME is a data format, which condenses binary structures as a text only format. MHTML allows applications to deliver MIME structures. The format requests from MIME may be manipulated by an attacker to inject malicious code in the victim’s computer. The vulnerability is similar to cross-site scripting attacks. However, in the malicious script may be executed in the client side context.

An attacker may place an HTML link with malicious code on a website and tempt users to click on the link. When users accessing the site through Internet Explorer click on the link, the malicious code gets executed in their system. Usually, software developers find vulnerabilities through ethical hacking. In this case, Microsoft found that a proof-of-concept code for exploiting the vulnerability is available in the wild.

Once executed, the malicious script may spoof the content, reveal information and perform arbitrary actions on the website on behalf of the targeted user without latter’s input. The extracted information may be misused by the attackers. The vulnerability affects all versions of Windows. Information security professionals at Microsoft are working with other partners to provide protection from the vulnerability. Meanwhile, Microsoft has provided a fixit solution. The fix it wizard has two options. The enable option locks down MHTML and the disable option unlocks the MHTML.

Disabling ActiveX controls and Active scripting in Internet Explorer may also provide some protection to users. Microsoft may consider issuing a patch for the zero day vulnerability during one of its upcoming security updates.