Posted on 12/14/2001 4:28:11 PM PST by peabers
Microsoft has released a cumulative patch for Internet Explorer which the firm says is a "critical" security precaution against crackers which should be applied "immediately".
Installation of the mother of all patches "eliminates all previously discussed security vulnerabilities affecting IE 5.5 and IE 6" as well as tackling three newly discovered vulnerabilities, according to a security alert from Microsoft.
The first, and by far the worst, vulnerability involves a flaw in the way IE 6 handles Content-Disposition and Content-Type header fields in an HTML.stream, which determine how a downloaded file is handled. The flaw means if an attacker altered the HTML header information in a certain way, it could be possible to make IE believe that an executable file was a different type of file, such as a text file that could be opened with minimal risk.
The vulnerability, which affects IE 6.0 only and not IE 5.5, means a cracker could create a Web page or HTML mail that, when opened, "would automatically run an executable on the user's system". It was discovered Jouko Pynnonen of Oy Online Solutions.
Next up is a less serious vulnerability which could allow a malicious Web site operator to open two browser windows, one in the web site's domain and the other on the user's local file system, and to pass information from the latter to the former. This means the owner of malware.com could read, but not change, local PC files of any surfer he manages to lure to his site. However he'd have to know the name and location of the file he was looking for, which must be something that can be viewed in a browser.
This vulnerability, which affects both IE 5.5 and 6.0, is a variant of the "Frame Domain Verification" bug.
Lastly there's a flaw related to the display of the names of downloaded files. It's been discovered that it might be possible for a cracker to misrepresent the name of the file in a dialogue box, which could be used to fool users into accepting unsafe file types. Again the bug affects both IE 5.5 and 6.0.
External Links
Microsoft's critical security alert
Unfortunately - that's what it'll turn into.
I also recently purchased what looks like a lawn ornament but is actually a tiger repeller. That, too, works as adevrtised---not one attack since installation.
This update eliminates all known security vulnerabilities affecting Internet Explorer 5.5 Service Pack 2 (SP2)
Do I need this if I am running version 5.50,4134,0600 128-bit encryption?
I don't want to download something I don't need.
"If it ain't broke, don't fix it."
'Course, theres the obvious risk...
It's not like yelling "fire" in a theatre since your correspondence is supposed to be "private."
I suppose, when the BATF knocks down your door, you could always say you were "creating" material for a book...
How much for the tiger repeller? Man can never be too safe.
But, on the other hand the Unix and Sun based hacks are on the increase as well, as they gain popularity in both the corporate and private sectors. And they're hacks that are just as deadly as some of the Microsoft's.
The interesting part will be to see if Unix and Sun fall into the same trap as Microsoft, in that trying to meet the demands of the users, they're forced to spread out their support and offerings, which in turn open up more doors for the black hats.
Either way, both products are totally vulnerable straight out of the box. Although you'll never hear many of the Unix elitists admit that.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.