Benjamin Tobias Franz has discovered a vulnerability in Internet Explorer, which can be exploited by malicious sites to detect the presence of local files.

The problem is that an "Access is Denied" error will be returned if a site in the "Internet" zone tries to open an existing local file in the search window using the "res:" URI handler. This can be exploited to determine the presence of specific programs or files in the system directories and on the desktop.

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP1.

Solution
The vulnerability does not affect systems running Windows XP with SP2 installed.
Further details available in Customer Area

Provided and/or discovered by
Benjamin Tobias Franz

Deep Links
Links available in Customer Area