Microsoft plugs holes with a six-pack

Microsoft yesterday re-released a cumulative security patch for Internet Explorer (IE) designed to fix six - yes six - holes in the web browser.

The patch was released and pulled at the end of last week because errors in the software packaging botched the fixes.

Security watchers at first greeted the release with relief. Only a month after Bill Gates vowed to turn the company's focus onto software security, a patch appeared which promised to fix a number of major bugs in IE. But relief quickly turned to confusion as the patch disappeared again.

It reappeared yesterday as security bulletin MS02-005. Assuming it works this time, the patch promises to fix six vulnerabilities, the most serious of which could allow an attacker to run code on another user's system.

Microsoft has given the cumulative patch a 'critical' rating as one of the holes it fixes is a vulnerability found in January, associated with the GetObject scripting function.

This could allow a malicious website administrator to read files on the computer of a visiting user's system or even execute arbitrary code.

The cumulative patch can be found on the Microsoft security website here.