Microsoft releases patch to fix IE security hole

From...

July 6, 2000
Web posted at: 8:27 a.m. EDT (1227 GMT)

by Kathleen Ohlson

(IDG) -- Microsoft has issued a patch for an Internet Explorer bug that it said could overwrite files and eventually crash computers.

The vulnerability in the browser's Active Setup Download feature could enable malicious hackers or Web site operators to launch denial-of-service attacks, Microsoft said in a bulletin that accompanies the patch. The fix for the security hole was released last Thursday.

MESSAGE BOARD Microsoft     ALSO Microsoft hacks IE 5.5 for Mac   MORE COMPUTING INTELLIGENCE   IDG.net home page   Computerworld's home page   Computerworld's Security Watch   Microsoft patches e-mail security   Microsoft acknowledges browser flaw   Reviews & in-depth info at IDG.net   E-BusinessWorld   TechInformer

The Active Setup control detects which files are needed by users who are updating software and then downloads the relevant ones. It's supposed to check to see whether the files are digitally signed before downloading them and warn users if files aren't signed or are signed by someone who doesn't have proper authorization, according to Microsoft.

But the mechanism has two flaws, Microsoft said. First, Microsoft-signed files are treated as trusted content, which means Internet Explorer will download them without asking for a user's approval. In addition, the control allows download locations to be specified on a user's hard drive, which Microsoft said could give malicious attackers a tool for overwriting system files and rendering machines unusable.

However, Microsoft added that attackers couldn't modify files or cause other damage to a computer other than crashing the system. The flaw affects Versions 4, 4.01, 5 and 5.01 of Internet Explorer, the company said.

Microsoft unveils a new Office for Macintosh
June 19, 2000
Microsoft releases latest Outlook security 'patch'
June 8, 2000
Check digital certificates in Internet Explorer 4 and 5, users cautioned
June 8, 2000
Microsoft to delay Outlook patch
May 26, 2000
Outlook patch called overkill
May 23, 2000

Microsoft, CERT disagree on IE patch
(Computerworld)
Caution urged over digital certificates in Internet Explorer
(Computerworld)
Microsoft squashes 'Paperclip' bug
(Computerworld)
Microsoft acknowledges browser flaw
(The Industry Standard)
Netscape posts security fix
(PC World)
Security hole found in Network Associates firewall
(Computerworld)
Microsoft patches e-mail security
(PC World)
Microsoft to patch Active Directory
(Network World Fusion)

Microsoft

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.