Four Year Old Security Issue Reportedly Reappears in IE 5.5 and 6.0
Newsbytes reports that security experts have discovered that Microsoft Internet Explorer fails to implement a security standard created in 1997. The standard, referred to as the "same-origin policy" requires that JavaScript code executing in the context of one Web site should not be able to access the properties of another. When this policy is not implemented "... a grab-bag of techniques {are available to attackers} for stealing other users' browser cookies, reading some files on their hard disks, and 'spoofing' the content of legitimate sites".
According to a SecurityFocus report on the flaw, "This violation of the 'same-origin policy' is a severe security vulnerability. There are many ways that an attacker could exploit this vulnerability."