IE browser security flaws in Microsoft Windows XP SP2

        A security researcher found that new flaws in Microsoft's Windows XP Service Pack 2 could result in people being put into executable programs on this completely patched system. The researcher is known as the operator of the Http-equive and Malware.com websites. He found a flaw in the local security zone of Microsoft Internet Explorer, which can exceed the security restrictions of the local security zone by using Html's help control. Researchers have found that if combined with another single defect, that is, drag and drop operations can make the system executable, the result of the attack is the implantation and execution of potentially malicious code from external websites. The researcher provided proof of concept illustrations on the website. The conceptual illustration of the drag-and-drop component goes beyond the scope of Microsoft's recently released related defect patch. Larholm, a senior researcher at PivX Solutions, points out that Microsoft patches designed for MS04-038 do not directly address drag-and-drop issues. Microsoft patches protect against defects by limiting the types of files used by DYNSRC. Larholm pointed out that DYNSRC stipulates the address of the media target used by the web page, as the defect finder pointed out in the original report, this restriction can be taken. He also said that this problem is relatively small, and Microsoft can solve it without much trouble. During this time, users can configure "Kill Bit" in the registry to prevent special command line targets from working (Shell.Explorer). A registry fix to fix this defect is available on the PivX website. The security company said that in order to implant and run the attack program, the user must perform a drag and drop operation. In actual attacks, users may be tempted by files such as images or music, which may contain attack programs. A Microsoft spokesperson said the company is investigating a flaw in Window XP Service Pack 2, which allowed an attacker to implant malicious files in the user's system.