DescriptionInternet Explorer 6.0 (and possibly other versions) reveal details of software installed on your system. When you fetch a website, IE sends a request like this: GET / HTTP/1.1 It is the "Accept:" header that is the problem. If you have all of Office installed, then the accept header looks like this: Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */* So, completely hidden from you, IE is revealing whether you have Excel, PowerPoint or Word installed, to every website you visit. Is this a bug?I'm sure that Microsoft could completely justify this design as being useful. For example it lets servers return different document types depending on what the client can read. However, I think this is leaking far too much information about your system. The information may even be useful to hackers, as there have been security problems with these programs in the past, e.g. macro viruses. I can only speculate at what information is leaked in the cryptic-looking "Accept-Language:" header. SolutionFortunately you can stop the information leakage quite easily, by editing the registry. Just delete the affected keys from this branch: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents The solution comes from this article on Kimihia. © 1998 - 2012
Paul Johnston, distributed under the BSD License Updated:15 Dec 2007 |