Microsoft offers fix for two IE security holes

From...

By James Niccolai

(IDG) -- Microsoft released a security patch Thursday designed to fix two security vulnerabilities in certain versions of its Internet Explorer Web browser, the company said in a bulletin on its Web site. Microsoft characterized the problems as 'critical.'

One hole could allow a malicious script embedded in a cookie to be run in an area of a user's PC known as the "local computer zone," where it could alter or delete files on a user's PC. Scripts embedded in cookies are supposed to be run, in most cases, in an area known as the Internet zone, which places tighter restrictions on how programs can behave.

A second vulnerability involves the way object tags are handled and could allow an attacker to invoke an executable file already present on a user's machine, Microsoft said. A malicious hacker could create a Web page that includes the object tag and cause the executable to run, the company said.

Users are advised to read Microsoft's security bulletin on its Web site, which includes instructions on how to download a software patch designed to fix the problems. They affect Internet Explorer Versions 5.01, 5.5 and 6.0, Microsoft said. The patches available are cumulative, meaning they include the functionality of all previously released patches for those versions of Internet Explorer.