IE6 flaw may allow drive-by hacking
Published: 28 Oct 2006 18:52 BST
Microsoft is investigating a flaw in Internet Explorer 6, according to a posting on the software maker's Security Response Center blog.
The ADODB.Connection ActiveX control in Internet Explorer 6.x may contain a vulnerability that can cause memory corruption, and therefore crash the browser. It is possible this new threat, considered by Microsoft to be a low risk, could be used by criminal hackers for so-called "drive-by" downloads, where software is automatically installed on a user's machine.This vulnerability has been assigned a National Vulnerability Database number of CVE-2006-5559. For instructions on disabling ActiveX, see this US-CERT document.






