Microsoft patch for IFRAME vulnerability

  • Thread starter Thread starter aD
  • Start date Start date
A

aD

It seems that Microsoft have just released a "Cumulative Security Update
for Internet Explorer" of which fixes include the IFRAME vulnerability.

http://www.microsoft.com/technet/security/bulletin/MS04-040.mspx

The article references some potential problems you may have with the
update, so please read through any relevant URLs it specifies to make sure
that you don't get yourself in a sticky situation - but also take a backup
beforehand as well! :-)


aD
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1




Technical Cyber Security Alert TA04-336A

Update for Microsoft Internet Explorer HTML Elements Vulnerability

Original release date: December 1, 2004
Last revised: --
Source: US-CERT



Systems Affected

Microsoft Windows systems running

* Internet Explorer versions 6 and later (see MS04-040 for affected
software and components)

* Other programs that host the WebBrowser ActiveX control



Overview

Microsoft Security Bulletin MS04-040 contains an update to fix a
buffer overflow vulnerability in Internet Explorer.



I. Description

TA04-315A describes a buffer overflow vulnerability in Microsoft
Internet Explorer HTML elements that could allow a remote attacker to
execute arbitrary code. Note that any program that hosts the
WebBrowser ActiveX control could be affected. Microsoft Security
Bulletin MS04-040 contains an update to fix this vulnerability.

The vulnerability is described in further detail in VU#842160.



II. Impact

By convincing a user to view a specially crafted HTML document (e.g.,
a web page or an HTML email message), an attacker could execute
arbitrary code with the privileges of the user. The attacker could
also cause IE to crash.

Reports indicate that this vulnerability is being exploited by
malicious code referred to as MyDoom.{AG,AH,AI} or Bofra.



III. Solution

Install an update

Install the appropriate update according to Microsoft Security
Bulletin MS04-040. For additional information about the update,
including possible adverse effects, please see Microsoft Knowledge
Base articles 889293 and 889669.



Appendix A. References

* Microsoft Security Bulletin MS04-040 -
<http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx>

* MS04-040: Cumulative Security Update for Internet Explorer (IE 6.0
SP1) - <http://support.microsoft.com/kb/889293>

* An update rollup is available for Internet Explorer 6 SP1 -
<http://support.microsoft.com/kb/889669>

* US-CERT Technical Cyber Security Alert TA04-315A -
<http://www.us-cert.gov/cas/techalerts/TA04-315A.html>

* Vulnerability Note VU#842160 -
<http://www.kb.cert.org/vuls/id/842160>

* About the Browser (Internet Explorer - WebBrowser) -
<http://msdn.microsoft.com/workshop/browser/overview/Overview.asp>

_________________________________________________________________

Feedback can be directed to the authors: Will Dormann and Art Manion.

Send mail to <[email protected]>.

Please include the Subject line "TA04-336A Feedback VU#842160".

_________________________________________________________________

Copyright 2004 Carnegie Mellon University.

Terms of use: <http://www.us-cert.gov/legal.html>

_________________________________________________________________

The most recent version of this document can be found at:

<http://www.us-cert.gov/cas/techalerts/TA04-336A.html>

_________________________________________________________________


Revision History

December 1, 2004: Initial release




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQa5IqhhoSezw4YfQAQK9ZAf7BHn69m5KRp64ePmJii0a1UCmZLimEdoF
16f11YLjUZljUvCjDD21pPv0jiPYY5cmFcHXZdlpovu/x6FnxuNvmV0GUYGENy27
qSzBt6aHc2oAHsouxb77x9ZIlg/k6+yjX82HqcR9+ITIXDx5SfTEz4jJsCJ86I7y
UTZqpMSQIniE8QDJ2VsoVnLylvC1RqgUCEXf+/526XDu/udIpQ+pahuewNUy+bgH
cj28U7WnjEAI9X/dgmCKu9znTtSfFL0Lm1YxDvF/tH1+q/9z9KmdldT16HbGPjJO
K0xbbFkpgKy9apXTF3MOzlb/ehXMXLgOwV37IXCD49TAhQy2FBe5CQ==
=w9cf
-----END PGP SIGNATURE-----



| Hi all...
|
| What is the latest you guys here have on this one?
| http://secunia.com/advisories/12959/
|
| It appears to have a few other names as well, which makes it hard to keep
| track of:
| http://www.f-secure.com/v-descs/bofra.shtml
|
| Any other names that might need to be taken note of?
|
| Jan :)
|
|
 
aD <[email protected]> squirted these wordjisms deep inside the
bumtube of the newstwat in
It seems that Microsoft have just released a "Cumulative Security
Update for Internet Explorer" of which fixes include the IFRAME
vulnerability.

http://www.microsoft.com/technet/security/bulletin/MS04-040.mspx

The article references some potential problems you may have with the
update, so please read through any relevant URLs it specifies to make
sure that you don't get yourself in a sticky situation - but also take
a backup beforehand as well! :-)


aD
Click to expand...


You could have helpfuly included that users running SP2 are NOT affected.
After all, it's mentioned on the page you refer to, and it is relevant.

--
*********************************
David Qunt
Click to expand...
****************************************************
 
David said:
aD <[email protected]> squirted these wordjisms deep inside the
bumtube of the newstwat in





You could have helpfuly included that users running SP2 are NOT affected.
After all, it's mentioned on the page you refer to, and it is relevant.
Click to expand...

And that Firefox isn't affected? (etc. ad infinitum)

I was aware that Windows XP SP2 was not affected - this /isn't/ to say I
knew that most people were aware of it.

I did go to start pasting bits of the article but figured I should post it
and be done with it :-)

You are quite right though, that fact is relevant and in the scheme of
things important, as it helps to show that SP2 does seem to be helping
security matters.


aD
 
Back
Top