Cumulative Patch For Internet Explorer December 2002
Posted by: [PM] on: 12/05/2002 11:23 AM [ Print | 0 comment(s) ] · 1670 views
This is a cumulative patch for Internet Explorer 5.5 and 6.0. In
addition to including the functionality of all previously released
patches for Internet Explorer 5.5 and 6.0, it also eliminates a
newly discovered flaw in Internet Explorer's cross-domain security
model. This flaw occurs because the security checks that Internet
Explorer carries out when particular object caching techniques are
used in web pages are incomplete. This could have the effect of
allowing a website in one domain to access information in another,
including the user's local system.
Exploiting the vulnerability could enable an attacker to read, but not change, any file on the user's local computer. In addition, the attacker could invoke an executable that was already present on the local system. The attacker would need to know the exact location of the executable, and would not be able to pass parameters to it. Microsoft is not aware of any executable that ships by default as part of Windows and, when run without parameters, could be dangerous. An attacker could exploit the vulnerability by constructing a web page that uses a cached programming technique, and could then either host it on a web site or send it to a user via email. In the case of the web-based attack vector the page could be automatically opened when a user visited the site In the case of the HTML mail- based attack vector, the page could be opened when the recipient opened the mail or viewed it using the Preview pane. Download here
Exploiting the vulnerability could enable an attacker to read, but not change, any file on the user's local computer. In addition, the attacker could invoke an executable that was already present on the local system. The attacker would need to know the exact location of the executable, and would not be able to pass parameters to it. Microsoft is not aware of any executable that ships by default as part of Windows and, when run without parameters, could be dangerous. An attacker could exploit the vulnerability by constructing a web page that uses a cached programming technique, and could then either host it on a web site or send it to a user via email. In the case of the web-based attack vector the page could be automatically opened when a user visited the site In the case of the HTML mail- based attack vector, the page could be opened when the recipient opened the mail or viewed it using the Preview pane. Download here
« How To Convert DivX / AVI / ASF / MPEG1 To VCD · Cumulative Patch For Internet Explorer December 2002
· Bonzi Class Action! »
