sceptyk
16.05.02, 22:03
Microsoft releases monster IE patch
Robert Lemos, CNET News.com
Microsoft urged Windows users to download a fix for Internet Explorer on
Wednesday, following the company's announcement that six new flaws had been
found in its Web browser.
The software giant called three of the flaws critical, but only one of them--a
cross-site scripting error that affects only Internet Explorer 6.0--would allow
an attacker or a worm to run a program on the victim's computer.
"Two of them are critical because of the possibility of information
disclosure," said Christopher Budd, security program manager for the Microsoft
security response team. "But they have steep requirements."
The first flaw occurs when the browser sends information within a link to
another browser. Known as cross-site scripting, the technique can be abused by
an attacker to get the other site to run a program specified by a malicious
user. The flaw outlined by Microsoft on Wednesday would require that the
attacker either host a Web page with the malicious link or send an HTML command
via e-mail.
The two critical flaws that could compromise user information occur because of
the way IE handles popular site templates, known as cascading style sheets, and
the way it processes cookies. Both require the exact names of files on the
target system to work, reducing the risk somewhat.
The other flaws and the patch can be found in the advisory.
Microsoft Windows XP users will automatically be prompted to install the update
by the operating system, while users of other Windows variants will have to go
to the Windows Update site.
The 2MB download includes all the old repairs for Internet Explorer 5.01, 5.5
and 6.0, plus patches for the latest six holes as well.
In addition to the patches, the software update additionally adds a
new "feature," restricts the default settings of the "Restricted Sites" zone to
block all frames
--------------------------------
Jak ktos chce linki to moge podrzucic. Patch po polsku tez tam jest.
sc-k