MS releases mother of all IE security patches

Apply 'immediately'


Microsoft has released a cumulative patch for Internet Explorer which the firm says is a "critical" security precaution against crackers which should be applied "immediately".

Installation of the mother of all patches "eliminates all previously discussed security vulnerabilities affecting IE 5.5 and IE 6" as well as tackling three newly discovered vulnerabilities, according to a security alert from Microsoft.

The first, and by far the worst, vulnerability involves a flaw in the way IE 6 handles Content-Disposition and Content-Type header fields in an HTML.stream, which determine how a downloaded file is handled. The flaw means if an attacker altered the HTML header information in a certain way, it could be possible to make IE believe that an executable file was a different type of file, such as a text file that could be opened with minimal risk.

The vulnerability, which affects IE 6.0 only and not IE 5.5, means a cracker could create a Web page or HTML mail that, when opened, "would automatically run an executable on the user's system". It was discovered Jouko Pynnonen of Oy Online Solutions.

Next up is a less serious vulnerability which could allow a malicious Web site operator to open two browser windows, one in the web site's domain and the other on the user's local file system, and to pass information from the latter to the former. This means the owner of malware.com could read, but not change, local PC files of any surfer he manages to lure to his site. However he'd have to know the name and location of the file he was looking for, which must be something that can be viewed in a browser.

This vulnerability, which affects both IE 5.5 and 6.0, is a variant of the "Frame Domain Verification" bug.

Lastly there's a flaw related to the display of the names of downloaded files. It's been discovered that it might be possible for a cracker to misrepresent the name of the file in a dialogue box, which could be used to fool users into accepting unsafe file types. Again the bug affects both IE 5.5 and 6.0.

External Links

Microsoft's critical security alert


Tech Resources

Three reasons you need a hybrid multicloud

Businesses need their IT teams to operate applications and data in a hybrid environment spanning on-premises private and public clouds. But this poses many challenges, such as managing complex networking, re-architecting applications for the cloud, and managing multiple infrastructure silos. There is a pressing need for a single platform that addresses these challenges - a hybrid multicloud built for the digital innovation era. Just this Regcast to find out: Why hybrid multicloud is the ideal path to accelerate cloud migration.

3 Unexpected SAP Cloud Challenges and How to Conquer Them

In this white paper you'll discover the three main challenges plaguing both Enterprise IT operations and Managed Service Providers (MSPs) today, and learn how to overcome them.

Manage Office 365 licences better

Low costly is poor Office 365 license management? We all suspect that we either have too many licenses, or those Office 365 licenses are being underused. Either way, it’s the same problem: we’re wasting money. IT spending will go under the microscope in 2020, and this is a great place to look. So look on the bright side: over-purchasing and underuse are problems that you can fix, starting today. Find out how in this Regcast.

The Ransomware Hunt that Unearthed a Historic Banking Trojan

The Sophos Managed Threat Response (MTR) team provides customers with swift, human-led responses to the nastiest threats and most sophisticated adversaries.

Biting the hand that feeds IT © 1998–2020