Secunia

Description

Microsoft has issued patches, in another attempt to fix the well known cross domain vulnerabilities, allowing malicious web sites to access contents in other domains including local zone.

See former Secunia advisories regard this and similar issues:
http://secunia.com/advisories/7569/

The first vulnerability addressed in this advisory is also called "cross-frame dialogArguments access", this allows a malicious website to get access to other domains through the use of maliciously crafted dialog boxes, this includes the local security zone, the malicious website could place and execute arbitrary files.

The other vulnerability allows a website to call the showHelp() function, showHelp() will open a new webpage and use that, however because showHelp() runs with the privileges of the user, the next new webpage is executed in the local security zone, this could be used to place and execute arbitrary code.

Solution
Microsoft has issued patches, the patches supersedes MS02-068 and MS02-066 for 5.01.
Further details available in Customer Area

Changelog
Further details available in Customer Area

Original Advisory
http://www.microsoft.com/technet/security/bulletin/MS03-004.asp

Deep Links
Links available in Customer Area