Security Alert

One patch fits all

Microsoft has released a patch that fixes lots of old and new
vulnerabilities in IE 4 and 5, and one in IE 5.5. Most of these have the
potential to expose your private data over the Internet while you’re surfing.
The patch is available at: www. microsoft.com/windows/ie/download/critical/patch11.htm.
Some of the vulnerabilities it fixes are explained below.

"Frame domain verification" vulnerability

This vulnerability lets a malicious Website operator read
files on the machine of a visiting user.

A malicious Website operator could open a frame within a
browser window on your machine, and display a file from your local machine on
it. Ideally, IE’s cross-domain security model should prevent the two from
reading each other’s data, because the window is in the Website’s domain,
while the frame is in the local file system domain. However, because of three
functions in IE that don’t perform domain checking properly, script running in
the window can send the contents of the frame to the malicious Website, which
means that your local data can be read, but not changed, by the Website
operator. However, the Website operator could access only files that can be
opened in a Web browser, for example, TXT, HTM, or JS files, and he would need
to know, or guess, the names and paths of the files he wants to access. Also,
you can disable Active Scripting from IE’s Security Settings (see box
"Zoning sites" for more details) as a workaround.

Versions affected are IE 4, 4.01, 5, and 5.01.

"Scriptlet rendering" vulnerability

An ActiveX control–called Microsoft Scriptlet Component–that
ships as part of IE, and is used to render HTML pages, can render non-HTML files
as well. Scriptlets are used by Web developers to script code that provides
additional services and functions, such as linking Web pages, performing
animation, etc, which then appear as part of the base HTML language. Scriptlets
are implemented as HTML files, and when a Web page needs to use the additional
functionality, it uses the Microsoft Scriptlet Component to render the file in
IE. This Component has a vulnerability that enables it to render any type of
file. This would not be too big an issue in most cases, because most files don’t
contain data that can be interpreted as HTML code.

However, a malicious Website operator could use this
vulnerability to introduce valid HTML code into a non-HTML file stored on your
machine. He could then use the Scriptlet Component to render this file. This
would make the script run in the Local Computer Zone, and would give operator
access to local files on your system. All he needs for doing this is the name
and location of any file on your system, in which he can insert the HTML code.
What can give him this information is the catalog file of previously-viewed Web
pages that IE stores in a known location. This file also contains information
provided by the Website. So, the operator could send bogus catalog information
that consists of HTML script, and use the Scriptlet component to render the file
and make the script available to his Website.

Versions affected are IE 4.x and 5.x.

"Active Setup Download" vulnerability

This vulnerability allows a malicious Website operator to
overwrite files on your system.

The Active Setup Control is an ActiveX control, which ships
with IE. This control is used to help manage software updates over the Internet,
Windows updates, for example. It’s set up to automatically download CAB files
which have been digitally signed by Microsoft, which is treated as a
"trusted" source, as part of installing software updates on your
machine. What leads to the vulnerability is two factors–one, the control doesn’t
prompt you when downloading a file that has been digitally signed by Microsoft;
and two, the caller–the entity who activates the Active Setup Control, in this
case the Website from where you’ll download the update–can specify the
location and path of a directory where you want the file to be installed.

So, what a mischief-monger can do is download
Microsoft-signed updates from the Microsoft Website to his own site, and since
these are trusted by default, he can then download them to your machine without
your knowledge. Since the ActiveX control allows him to specify the path and
file name to which the file should be downloaded, he could overwrite any file on
your system. If this were a crucial system file, your system could even crash,
and you wouldn’t have an inkling of what happened.

However, if you’re running Win 2k, your critical system
files would be protected via a feature called System File Protection (SFP).
Also, you could use the Security Zones feature in IE. This feature lets you
divide the sites you visit into different zones, and grant privileges levels to
the sites in these zones (see box "Zoning sites" for more details).

IE 5.5 users can use the patch mentioned above to safeguard
themselves against this vulnerability. Users of IE 4.01 SP2, IE 5.01, and IE
5.01 SP1 can download a patch from www.microsoft. com/windows/ie/download/critical/patch8.htm.

"IE Script" vulnerability

This vulnerability can allow malicious script code on a Web
page to reference a remotely hosted MS Access file, which in turn can cause a
VBA or macro–which could be malicious–in the file to be executed. All this
would happen without giving you any prompt or warning.

By default, Access files are marked as unsafe for scripting,
but a script tag called the

Apart from vulnerabilities fixed by the patch mentioned
earlier, another vulnerability has been found in Excel 2000 and PowerPoint
97/2000, which allows a remotely-hosted file to be saved on your hard disk:

"Office HTML Script" vulnerability

This allows malicious script running on a Website to
reference an Excel 2000 or PowerPoint 97/2000 file such that a file hosted on
the Website can be saved to your hard drive.

For example, an HTML file can contain script code that
executes when you reference the file from IE or through a link in e-mail. This
script code can then reference a remotely hosted Excel or PowerPoint file, which
can invoke a function within VBA (Visual Basic for Applications)–the SaveAs
function–to save a file to your local hard drive.

A workaround for this is to go to disable "Run ActiveX
controls and plug-ins" from the security settings in Internet Explorer (see
box "Zoning sites" for more details). A patch for this vulnerability
is available at:

Excel 2000 and PowerPoint 2000: http://officeupdate.microsoft.com/2000/downloaddetails/Addinsec.htm

PowerPoint 97: http://officeupdate.
microsoft.com/downloaddetails/PPt97sec.htm