WiFi Finder
Locate wireless services by a specific address, city, state, country, airport, or zip code.
Is Microsoft's IE Patch Flawed?
Security researchers claim a hole remains that can give hackers access through Outlook, IE.
Sam Costello, IDG News Service
A new patch designed to address six serious security vulnerabilities in Microsoft Internet Explorer doesn't fix all the problems it purports to, according to security researchers.
The patch, which was released late Wednesday, is designed to fix a cross-site scripting problem and other security and privacy flaws affecting Internet Explorer (IE) versions 5.01 through 6 and the Outlook e-mail client. However, the patch fixes only the cross-site scripting issue on one of the listed browsers, according to two security researchers who sent e-mail to the Bugtraq security e-mail list after the patch's release.
Flawed Fix?
According to Microsoft's explanation of the issue, the flaw can be exploited only when a user clicks on an HTML link on a Web page or in an e-mail message. That's not true, as code embedded in an HTML file can automatically execute, according to both Thor Larholm, a security researcher who has discovered a number of Microsoft vulnerabilities and maintains a list of unpatched IE holes online. Larholm's assertion is backed by the Israeli security group GreyMagic Software, which has also discovered a number of browser vulnerabilities.
As a result, users can unwittingly launch malicious code simply by opening an infected e-mail message.
The patch doesn't completely fix the problem because the flaw resides in the dialogArguments component of IE, which is not addressed by the patch, both researchers said. Furthermore, though Microsoft claims the flaw only exists in IE 6, both researchers maintain that the problem is also found in IE 5.01 and 5.5.
Microsoft Investigates
Microsoft representatives say the current patch performs as necessary, but that the company is looking into the latest allegations.
"Microsoft is aware of the issues and is investigating the reports," a Microsoft spokesperson said. Microsoft maintains that the patch does what the company said, but the company is also investigating the researcher's claims, the spokesperson said.
This isn't the first time that a Microsoft patch has caused problems for users. Another IE patch, released in February, caused the browser to crash.
- Sponsored Resource:Improve your network with the right mix of features, performance and pricing.
- Sponsored Resource:Growing your business requires the right tools. Dell's networking servers can help.
- Sponsored Resource:Thinking about a new Laptop? Lenovo has models to meet everyone's needs.
- Sponsored Resource:Twitter: A how-to guide for using Twitter as a business tool.
- Sponsored Resource:Smartphone security threats are on the rise. Is it time to safegaurd your device?
Print 65% more pages than with refilled inks. Trust Original HP Inks. Hit Print Reliably.
Microsoft Office Home and Student 2007
Laptop Showcase
People who read this also read:
Best Prices on Security Software
Norton Internet Security 2009 - 1 User/3 PCPrice: $20.53
Norton Internet Security 2009 - 1 User/1 PCPrice: $15.95
Internet Security 2009Price: $15.99
Norton 360Price: $25.00
Norton Internet Security 2009 - 1 User/3 PC, Small BoxPrice: $20.45
Internet Security 2009Price: $24.95
- 2007 Microsoft Office Suites Comparison This paper compares and contrasts four suites of the 2007 Microsoft Office system: Microsoft Office Standard 2007, Microsoft Office Professional Plus 2007, Microsoft Office Enterprise 2007 and Microsoft Office Ultimate 2007. This paper is intended to help organizations understand the applications and capabilities offered, and to identify the suite that best fits their needs.
- Windows Vista Migration: The Business Proposition It's not so much a matter of "if" but "when" for most organizations regarding migration to Windows Vista. Laying the groundwork now for this migration can yield higher ROI than waiting until later. This Computerworld Technology Briefing explains it all.
