Bugs and Fixes: Gaping Holes in Internet Explorer

Plugging holes in Internet Explorer is a perpetual whack-a-mole exercise--as soon as Microsoft patches one hole, the bad guys (or avid security researchers) expose new ones. Late in November, a massive security flaw in Internet Explorer prompted Microsoft to pump out a fix. On the heels of that patch, the company had to take care of six other, separate holes--and then a seventh one, two weeks later.

At about the same time, RealNetworks came under fire and patched three security problems in its RealOne Player that may affect its older RealPlayer program as well.

But first, IE's biggie: If you use IE 5.01, 5.5, or 6, make sure you fix the major hole involving IE's "Data Access Components," which let your browser talk to databases over the Internet, and which retrieve and return data to IE. If you click a malicious link, the vulnerability could allow an attacker to send too much data to your browser, causing one or more of the Data Access Components to fail. After that, theoretically, the offender could execute any code on your PC. If your system runs Windows XP, you're already protected. If it doesn't, get the details, as well as the link to the fix, from Microsoft.

Despite releasing Service Pack 1 for IE 6 last October and following up with a slew of other stand-alone fixes, Microsoft has rolled out two more cumulative patches. The first cumulative patch deals with six holes, but you're better off installing the second cumulative patch, as it handles those six vulnerabilities and a seventh one. The worst flaw could enable an Internet peeper to have a gander at data that you've stored on your PC.

Not every version of Windows is in danger of being hacked, but IE versions 5.01 through 6 are affected by six holes, while the seventh flaw affects IE 5.5 and 6. The situation gets complicated. Visit our Downloads page to discover whether your versions of Windows and IE are vulnerable, and to grab a link to the newer cumulative patch.

Get Real?

The three RealNetworks security defects endanger RealOne Player version 1. At press time, the company was not able to confirm whether earlier versions of the program (RealPlayer) are also susceptible. The potential attack would allow an invader to run arbitrary programs on a user's machine. A company spokesperson recommended that anyone using RealPlayer 8 or earlier versions upgrade their program to RealOne Player version 2. Jump to the RealNetworks support site for more details and for the update to fix your player. Alternatively, within the player, select Tools, Check for Update.