Microsoft late Wednesday issued a patch to fix a flaw in Internet Explorer (IE) that it says poses only a "moderate" risk to users. Security experts, however, say the vulnerability is serious and could be exploited to take over a user's machine.

The flaw affects IE 5.5 and IE 6.0 and lies in a feature meant to set up security boundaries between Web browser windows and the local system. Exploiting it could enable an attacker to read information on a user's computer and invoke programs already on the PC, according to a Microsoft security bulletin.

"This is an extensive downplaying of the severity," says Thor Larholm, a Copenhagen-based security researcher with PivX Solutions. "An attacker can in fact take any action on a system a local user could, including modifying files, formatting the hard drive and uploading applications."

This "external object caching" vulnerability was first made public in late October by Israeli security company GreyMagic Software, together with a score of other IE flaws.

An attacker could exploit the flaw by luring a user to an especially coded Web page or sending that page via HTML e-mail, Microsoft said. The Redmond, Wash., company advises users to consider applying the patch, part of a super patch that includes all previous IE 5.5 and IE 6.0 fixes.

Larholm, who has close ties to GreyMagic, warns that an exploit for the external object caching flaw will likely be out soon, since the flaw was first made public in October. He urges users to patch up as soon as possible. Another 18 publicly known but unpatched vulnerabilities remain in IE, of which six are serious, Larholm said.

Microsoft last month changed the way it rates security issues because customers complained they could not identify the most serious vulnerabilities, the company has said.

Under the new system, fewer bulletins get the "critical" stamp. The only vulnerabilities now rated critical are those that could be exploited to allow malicious Internet worms to spread without user action. Many issues that were previously rated critical are now "important," a new category in the rating system. Important vulnerabilities could expose user data or threaten system resources.

Rated "moderate" are vulnerabilities that are difficult to exploit because of default configuration, auditing, or just plain difficulty of exploitation, according to Microsoft's rating scheme.

The IDG News Service is a Network World affiliate.