News

Microsoft Updates IE Patch Due to VML Flaw

Microsoft this week released an update to a 2007 Internet Explorer patch covering Internet Explorer 5.01, Internet Explorer 6 and Internet Explorer 7.

Microsoft this week released an update to a 2007 Internet Explorer patch covering Internet Explorer 5.01, Internet Explorer 6 and Internet Explorer 7.

The update comes as Redmond issued Internet Explorer 8 Beta 2 this week. It follows the company's cumulative general security patch release for August, which included critical fixes for Microsoft's browser application.

The software giant says this latest IE security update, which was published on Wednesday, "resolves a privately reported vulnerability" in the Vector Markup Language (VML) implementation in Windows. The main purpose of VML is to allow servers to communicate with one another and share structured data, particularly via the Web.

The patch, first released in August 2007, was designed to stave off remote code execution (RCE) exploits. RCE attacks occur when an end user or administrator opens up a maliciously crafted Web page or Hypertext Markup Language file.

The updated IE patch addresses the kill bit for ActiveX controls, as well as the way certain strings in cascading style sheet (CSS) files are configured and aggregated for Web publishing.

The patch applies to IE 5.01 and IE 6 Service Pack 1, and Windows XP Home and Professional Editions, but Microsoft added a fix for the latest version of IE 7 with this update. Microsoft suggests that IT pros and users with the applicable version of IE install the patch immediately.

Security experts mainly see this rerelease as routine. However, it's important for Microsoft to have all of its ducks in a row ahead of its much-heralded IE release, especially when the company banks on having improved security in Internet Explorer. Microsoft has not officially announced a release date for the non-beta version of Internet Explorer 8.

"Overall, unpatched systems and lack of user awareness, coupled with the number of people freely roaming the Internet, makes these [RCE vulnerabilities] more profitable and more easily exploitable than the remote attacks from days-gone-by," said Tyler Reguly, a security engineer for nCircle, a San Francisco-based network security firm. "We're seeing a lot of the same things we've seen in the past in regards to what's being patched as far as IE, and it's as important as ever for [Microsoft]."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Hyper-V Architecture: Some Clarifications

    Brien answers two thought-provoking reader questions. First, do Hyper-V VMs have direct hardware access? And second, how is it possible to monitor VM resource consumption from the host operating system?

  • Old Stone Wall Graphic

    Microsoft Addressing 36 Vulnerabilities in December Security Patch Release

    Microsoft on Tuesday delivered its December bundle of security patches, which affect Windows, Internet Explorer, Office, Skype for Business, SQL Server and Visual Studio.

  • Microsoft Nudging Out Classic SharePoint Blogs

    So-called "classic" blogs used by SharePoint Online subscribers are on their way toward "retirement," according to Dec. 4 Microsoft Message Center post.

  • Datacenters in Space: OrbitsEdge Partners with HPE

    A Florida-based startup is partnering with Hewlett Packard Enterprise in a deal that gives new meaning to the "edge" in edge computing.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.