Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

MS releases mother of all IE security patches
The Register ^ | 14/12/2001 | John Leyden

Posted on 12/14/2001 4:28:11 PM PST by peabers

Microsoft has released a cumulative patch for Internet Explorer which the firm says is a "critical" security precaution against crackers which should be applied "immediately".

Installation of the mother of all patches "eliminates all previously discussed security vulnerabilities affecting IE 5.5 and IE 6" as well as tackling three newly discovered vulnerabilities, according to a security alert from Microsoft.

The first, and by far the worst, vulnerability involves a flaw in the way IE 6 handles Content-Disposition and Content-Type header fields in an HTML.stream, which determine how a downloaded file is handled. The flaw means if an attacker altered the HTML header information in a certain way, it could be possible to make IE believe that an executable file was a different type of file, such as a text file that could be opened with minimal risk.

The vulnerability, which affects IE 6.0 only and not IE 5.5, means a cracker could create a Web page or HTML mail that, when opened, "would automatically run an executable on the user's system". It was discovered Jouko Pynnonen of Oy Online Solutions.

Next up is a less serious vulnerability which could allow a malicious Web site operator to open two browser windows, one in the web site's domain and the other on the user's local file system, and to pass information from the latter to the former. This means the owner of malware.com could read, but not change, local PC files of any surfer he manages to lure to his site. However he'd have to know the name and location of the file he was looking for, which must be something that can be viewed in a browser.

This vulnerability, which affects both IE 5.5 and 6.0, is a variant of the "Frame Domain Verification" bug.

Lastly there's a flaw related to the display of the names of downloaded files. It's been discovered that it might be possible for a cracker to misrepresent the name of the file in a dialogue box, which could be used to fool users into accepting unsafe file types. Again the bug affects both IE 5.5 and 6.0.

External Links
Microsoft's critical security alert


TOPICS: Business/Economy; Front Page News; News/Current Events
KEYWORDS: techindex
Navigation: use the links below to view more comments.
first 1-2021-38 next last
This is meant as a public service announcement, and not the start of a browser war.
1 posted on 12/14/2001 4:28:11 PM PST by peabers
[ Post Reply | Private Reply | View Replies]

To: tech_index
Filing
2 posted on 12/14/2001 4:28:40 PM PST by peabers
[ Post Reply | Private Reply | To 1 | View Replies]

To: peabers
bump
3 posted on 12/14/2001 4:32:56 PM PST by BansheeBill
[ Post Reply | Private Reply | To 1 | View Replies]

To: peabers
This is meant as a public service announcement, and not the start of a browser war.

Unfortunately - that's what it'll turn into.

4 posted on 12/14/2001 4:32:58 PM PST by TomServo
[ Post Reply | Private Reply | To 1 | View Replies]

To: peabers
Thank you. Love the title of the article.
5 posted on 12/14/2001 4:34:09 PM PST by SmartBlonde
[ Post Reply | Private Reply | To 1 | View Replies]

To: peabers
Thanks
6 posted on 12/14/2001 4:40:31 PM PST by StayoutdaBushesWay
[ Post Reply | Private Reply | To 1 | View Replies]

To: peabers
I realize this shouldn't be a browser or OS war so I won't go there, but IMHO Microsoft could greatly increase their credibility by undergoing an internal security audit of all their source code. Say one billion $ over two years. Remove gimmicky scripting support except for a restricted chroot sandbox and leave it at that. A drop in the bucket in the larger scheme of things.
7 posted on 12/14/2001 4:40:45 PM PST by SpaceBar
[ Post Reply | Private Reply | To 1 | View Replies]

Comment #8 Removed by Moderator

To: peabers
Thanks, I just installed the download.
9 posted on 12/14/2001 4:53:49 PM PST by lancer
[ Post Reply | Private Reply | To 1 | View Replies]

To: Bush2000
Another example of superior Microsoft (in)security in its products for you? Can't deny this one, I guess, so you can't defend it. The silence is deafening.
10 posted on 12/14/2001 4:54:29 PM PST by Fractal Trader
[ Post Reply | Private Reply | To 1 | View Replies]

To: Fractal Trader
Hackers all work on Microsoft because the other OSes aren't widely enough used to bother with.
11 posted on 12/14/2001 4:58:38 PM PST by Cicero
[ Post Reply | Private Reply | To 10 | View Replies]

To: peabers
I just installed the new security patch and rebooted. To my satisfaction it worked like a charm. I haven't been hacked since installation and what a relief that is.

I also recently purchased what looks like a lawn ornament but is actually a tiger repeller. That, too, works as adevrtised---not one attack since installation.

12 posted on 12/14/2001 5:04:30 PM PST by Rudder
[ Post Reply | Private Reply | To 1 | View Replies]

Comment #13 Removed by Moderator

To: peabers;all
From your link:

This update eliminates all known security vulnerabilities affecting Internet Explorer 5.5 Service Pack 2 (SP2)

Do I need this if I am running version 5.50,4134,0600 128-bit encryption?

I don't want to download something I don't need.

"If it ain't broke, don't fix it."

14 posted on 12/14/2001 5:08:12 PM PST by mdittmar
[ Post Reply | Private Reply | To 1 | View Replies]

To: peabers
bump for when I get home, since I'm using netscape at work.
15 posted on 12/14/2001 5:13:45 PM PST by RobRoy
[ Post Reply | Private Reply | To 1 | View Replies]

To: Noxxus
Hey, another fun thing to do on the internet is create yourself two hotmail accounts and then pass yourself emails back and forth about a fictitios terrible illegal act you are planning with "each other" and see if you reel any gub'ment types in.

'Course, theres the obvious risk...

It's not like yelling "fire" in a theatre since your correspondence is supposed to be "private."

I suppose, when the BATF knocks down your door, you could always say you were "creating" material for a book...

16 posted on 12/14/2001 5:18:24 PM PST by RobRoy
[ Post Reply | Private Reply | To 8 | View Replies]

To: Rudder
I also recently purchased what looks like a lawn ornament but is actually a tiger repeller. That, too, works as adevrtised---not one attack since installation.

How much for the tiger repeller? Man can never be too safe.

17 posted on 12/14/2001 5:27:56 PM PST by spectr17
[ Post Reply | Private Reply | To 12 | View Replies]

To: WileyCoyote22
Hackers all work on Microsoft because the other OSes aren't widely enough used to bother with. BS, there are plenty of hacks for Linux and Macs. Both are correct statements. Microsoft has long been a favorite target of hackers for numerous reasons. Widespread availability is one. Microsoft being perceived as the "evil" corporate empire is another. And since Microsoft gears their products for widespread use and compatibility, they're usually huge in coding compared to a dedicated program. Add in that Microsoft is most likely driven by Marketing (as most corporations) who only care if something works, not how it can break.

But, on the other hand the Unix and Sun based hacks are on the increase as well, as they gain popularity in both the corporate and private sectors. And they're hacks that are just as deadly as some of the Microsoft's.

The interesting part will be to see if Unix and Sun fall into the same trap as Microsoft, in that trying to meet the demands of the users, they're forced to spread out their support and offerings, which in turn open up more doors for the black hats.

Either way, both products are totally vulnerable straight out of the box. Although you'll never hear many of the Unix elitists admit that.

18 posted on 12/14/2001 5:30:36 PM PST by zandtar
[ Post Reply | Private Reply | To 13 | View Replies]

To: Fractal Trader
Another example of superior Microsoft (in)security in its products for you? Can't deny this one, I guess, so you can't defend it. The silence is deafening.

This is bad. But it's hardly the end of the world, as you'd portray it.
19 posted on 12/14/2001 5:41:56 PM PST by Bush2000
[ Post Reply | Private Reply | To 10 | View Replies]

Comment #20 Removed by Moderator


Navigation: use the links below to view more comments.
first 1-2021-38 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson