Microsoft Patches IE, Outlook Express Holes

Four security holes have been detected and patched in the world’s most
popular Web browser, Microsoft said on Wednesday,
warning that the vulnerabilities carry a ‘critical’ rating.

The security vulnerabilities in Microsoft’s flagship Internet Explorer
(IE) browser could allow an attacker to execute arbitrary code on a user’s
system if the user either browsed to a hostile web site or opened a
specially crafted HTML email message, the company warned.

On a day when it also warned of a ‘critical’ hole in its Outlook Express
e-mail client, the company issued a cumulative patch was issued for Internet
Explorer versions 5.01 through 6.0 and includes the functionality of all
previously released patches for the browser.

The first flaw — a buffer overrun vulnerability in URLMON.DLL — occurs
because the browser does not correctly check the parameters of information
being received from a web server. This leaves the door open for an attacker
to take control of a susceptible system by luring the user to visit a
Website.

Microsoft said a flaw in the Internet Explorer file upload control could
let an attacker supply a file name to the file upload control and
automatically upload a file from the user’s system to a web server.

The browser also contains a separate flaw in the way it handles the
rendering of third party files. “The vulnerability results because the
Internet Explorer method for rendering third party file types does not
properly check parameters passed to it. An attacker could create a specially
formed URL that would inject script during the rendering of a third party
file format and cause the script to execute in the security context of the
user,” Microsoft added.

The last hole was found in the way modal dialogs are treated by IE. This
flaw could be used by an attacker to gain access to files stored on a user’s
computer.

In addition to correcting those four flaws, Microsoft said the patch also
includes a fix for Internet Explorer 6.0 SP1 that corrects the method by
which the browser displays help information in the local computer zone.

The patch also sets the ‘Kill Bit’ on the Plugin.ocx ActiveX control
which has a security vulnerability.

Microsoft cautioned that the patch will cause window.showHelp( )
to cease to function if a user does not apply the HTML Help update.
“If you have installed the updated HTML Help control from Knowledge Base
article 811830, you will still be able to use HTML Help functionality after
applying this patch,” the company noted.

Separately, the software giant tagged the maximum severity rating on a cumulative patch for Outlook Express
versions 5.5 through 6.0 to fix a flaw that could allow an intruder to take
over a user’s machine.

To exploit the vulnerability, attacker would have to be able to cause
Windows to open a specially constructed MHTML URL, either on a web site or
included in an HTML email message.

News Around the Web