Danish firm finds flaws in security fixes
vnunet.com, 25 Nov 2002
Security patches released by Microsoft last week may not completely protect users, according to a Danish security consultancy.
Microsoft security alert 65 and alert 66 deal with the Windows operating system and Internet Explorer, and are rated 'critical' and 'important' respectively.
Alert 66, a bundled software patch for Internet Explorer versions five and six, is aimed at fixing six specific faults in the browser.
Simon Conant, of Microsoft product support services, said: "If users update with this patch they will be covered for all the currently known security flaws.
"They'll still need to use patch 65 as well as that's not a specific Internet Explorer patch but can affect the software."
But Danish security company Secunia said it has identified flaws with both patches.
Microsoft has admitted patch 65 may not be fully effective in certain circumstances, but it has made no mention of problems with patch 66.
Although patch 65 does offer a broad solution it is still vulnerable to malicious websites and HTML emails. If the browser downloads ActiveX controls automatically it might be possible to reintroduce malicious code.
The software giant has suggested that users remove its software from the Trusted Publisher list and check the software's origin before downloading.
Part of the flaw in patch 66 means it is still possible for a website to run an executable that is stored on a system.
This could allow an outsider to view the contents of a previously identified file and view the clipboard.
Secunia spotted the flaws while installing and checking the patches. Details of how to fix them can be found here.
"I was very shocked at the problems, particularly with alert 65," said Thomas Kristensen, chief technical officer of Secunia.
"We noticed the problems and only then did we find them mentioned in the FAQ. The only way around them is to manually install all digital certificates after checking their veracity, and who wants to do that?" he said.
Microsoft could not provide a comment on Secunia's discoveries by the time of going to press.
Security consultancy adamant that vulnerabilities pose serious threat
E-commerce minister Stephen Timms writes exclusively about the need for clear security guidelines if future generations are to benefit.
In part one of V3.co.uk's interview with Dirk Singer, he dicusses social media monitoring strategies
Remote access - Three steps to getting connected
3.4 million UK professionals now work from home – is your company equipped?
Cost benefits of a global collaboration network
This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications
Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.
Join our live chat session on Thursday at 11am to...
Researchers from security firm FireEye have been able to effectively...
Do you agree?
Have your say on this article