MS releases mother of all IE security patches

Apply 'immediately'

By John Leyden, 14th December 2001

Microsoft has released a cumulative patch for Internet Explorer which the firm says is a "critical" security precaution against crackers which should be applied "immediately".

Installation of the mother of all patches "eliminates all previously discussed security vulnerabilities affecting IE 5.5 and IE 6" as well as tackling three newly discovered vulnerabilities, according to a security alert from Microsoft.

The first, and by far the worst, vulnerability involves a flaw in the way IE 6 handles Content-Disposition and Content-Type header fields in an HTML.stream, which determine how a downloaded file is handled. The flaw means if an attacker altered the HTML header information in a certain way, it could be possible to make IE believe that an executable file was a different type of file, such as a text file that could be opened with minimal risk.

The vulnerability, which affects IE 6.0 only and not IE 5.5, means a cracker could create a Web page or HTML mail that, when opened, "would automatically run an executable on the user's system". It was discovered Jouko Pynnonen of Oy Online Solutions.

Next up is a less serious vulnerability which could allow a malicious Web site operator to open two browser windows, one in the web site's domain and the other on the user's local file system, and to pass information from the latter to the former. This means the owner of malware.com could read, but not change, local PC files of any surfer he manages to lure to his site. However he'd have to know the name and location of the file he was looking for, which must be something that can be viewed in a browser.

This vulnerability, which affects both IE 5.5 and 6.0, is a variant of the "Frame Domain Verification" bug.

Lastly there's a flaw related to the display of the names of downloaded files. It's been discovered that it might be possible for a cracker to misrepresent the name of the file in a dialogue box, which could be used to fool users into accepting unsafe file types. Again the bug affects both IE 5.5 and 6.0.