Cumulative Security Update for Internet Explorer (832894)

Advertisement (Why?)

Who should read this document: Customers who are using Microsoft® Internet Explorer

Impact of vulnerability: Remote Code Execution

Security Update Replacement: This update replaces the one that is provided in Microsoft Security Bulletin MS03-048, which is itself a cumulative update

Affected Software:
Microsoft Windows NT® Workstation 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Terminal Server Edition, Service Pack 6
Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
Microsoft Windows XP, Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Windows XP 64-Bit Edition Version 2003
Microsoft Windows Server® 2003
Microsoft Windows Server 2003, 64-Bit Edition

Download: Cumulative Security Update for Internet Explorer (832894)

View: More Information

News source: Microsoft TechNet via Bink

Dave arrived and set his laptop up, an IBM ThinkPad A31. He didn't connect to the Internet - too dangerous, and against regulations, if I recall - but instead ran his presentation software using movies and videos where others would have actually gone online to demonstrate their points. While he was getting everything ready, I took a look at the first FBI agent I could remember meeting in person.

Dave had some surprises up his sleeve as well. You'll remember that I said he was using a ThinkPad (running Windows!). I asked him about that, and he told us that many of the computer security folks back at FBI HQ use Macs running OS X, since those machines can do just about anything: run software for Mac, Unix, or Windows, using either a GUI or the command line. And they're secure out of the box. In the field, however, they don't have as much money to spend, so they have to stretch their dollars by buying WinTel-based hardware. Are you listening, Apple? The FBI wants to buy your stuff. Talk to them!

Dave also had a great quotation for us: "If you're a bad guy and you want to frustrate law enforcement, use a Mac." Basically, police and government agencies know what to do with seized Windows machines. They can recover whatever information they want, with tools that they've used countless times. The same holds true, but to a lesser degree, for Unix-based machines. But Macs evidently stymie most law enforcement personnel. They just don't know how to recover data on them. So what do they do? By and large, law enforcement personnel in American end up sending impounded Macs needing data recovery to the acknowledged North American Mac experts: the Royal Canadian Mounted Police. Evidently the Mounties have built up a knowledge and technique for Mac forensics that is second to none.

(I hope I'm not helping increase the number of sales Apple has to drug traffickers.)

(2 replies) #1 leebobs on 02 Feb 2004 - 18:25

So... err... which one of the 35 known exploits does this fix?

#1.1 SomeDork on 03 Feb 2004 - 02:16

Ok, what and where are these mysterious 35 exploits?

#1.2 chris_kabuki on 03 Feb 2004 - 13:57

#1.1 Maybe not 35, but 24 (http://www.safecenter.net/UMBRELLAWEBV4/ie_unpatched/index.html) at least! Some over 2 years old in fact.

(1 reply) #2 StuRReaL on 02 Feb 2004 - 18:30

the 35 ones prior to these but in one big update

this is why i use mozilla

#2.1 SomeDork on 03 Feb 2004 - 02:16

And Mozilla has no exploits whatsoever. Right.

#3 OptiPlex on 02 Feb 2004 - 18:37

YESSSSSSSSSSSSSSSSSSSSSSSS

(1 reply) #4 LordHatrus on 02 Feb 2004 - 18:40

Gee, it seems my copy of Microsoft Linux XP isn't affected by these security updates.....
amazing.....

#4.1 SomeDork on 02 Feb 2004 - 23:47

Yes, fictional products need no patches. Grats?

(4 replies) #5 edgrale on 02 Feb 2004 - 18:50

Kinda of topic but, do you guys have any idea why windowsupdate shows the "Download size" 10x the actual size?

#5.1 OptiPlex on 02 Feb 2004 - 18:53

no, but thats funny

#5.2 kiddingguy on 02 Feb 2004 - 19:00

who cares? i'm on cable and if I have to wait somewhat longer, that's fine by me (flat fee... ain't it lovely

)

#5.3 virtorio on 02 Feb 2004 - 22:31

WindowsUpdate has been doing for a while now.

#5.4 Andareed on 03 Feb 2004 - 01:04

Change your regional settings around. The problem was with the decimal place; you have to have 2 digits following number. I actually opened an official support session with ms support over it

(11 replies) #6 Mystr-.-Ajay on 02 Feb 2004 - 18:52

QUOTE

Who should read this document: Customers who are using Microsoft® Internet Explorer

/me moves on...

#6.1 OptiPlex on 02 Feb 2004 - 18:53

yea, thanks for telling us that you don't use IE.

like anyone cares.

#6.2 gameguy on 02 Feb 2004 - 20:08

good, move on. just stay away from me with your nightly updates

#6.3 Mystr-.-Ajay on 02 Feb 2004 - 21:37

better than a few patches a month that still leave holes..

#6.4 gameguy on 02 Feb 2004 - 22:59

what are you talking about?

this is only the 8th patch for IE6SP1 since november 2002...

http://www.microsoft.com/technet/treeview/...end=&submit1=go

#6.5 SomeDork on 02 Feb 2004 - 23:49

Don't bother the folks with facts. They'd rather uninstall and reinstall a new build of a beta browser and call it a "feature improvement" and not even notice the known bugs, holes or security flaws, and claim that IE6 has more holes even though the amount of patching ... not to mention the METHOD for patching ... is about 10x easier.

That's right ... move on.

#6.6 hotrod on 03 Feb 2004 - 00:34

Oh I see... since you guys install Mozilla/Firebird, that means you completely rid your machines of all traces of an integral part of your OS(like IE) and you are no longer at risk to it's vulnerabilities? smart idea, please keep flooding these and other forums with fudd....
same goes for post #2

#6.7 cws125 on 03 Feb 2004 - 03:44

Um.. HotRod.. most of IE's vulnerabilities occur ONLY if you are using Internet Explorer to view web pages. If you never use IE, you're not at risk. If it's an operating system vulnerability, however, THEN you need to worry about worms attacking your system, etc.

But all of IE's vulnerabilities are stuff like: you click a link in IE, and it spoofs IE's address bar. Or you go to www.badsite.com using IE, and it uses a cross-site scripting vulnerability to execute JavaScript in the context of another, trusted site in IE. If you don't go to www.badsite.com using IE, how can www.badsite.com do stuff to your computer?

And what are you talking about, GameGuy? Firebird and Mozilla has releases every other month or so (only development builds are updated nightly, much like how-- not trolling--Microsoft builds Longhorn every day for testing out new code), Opera also has releases, so what browser has nightly updates?

And SomeDork, why are you so sensitive about IE's security holes? How do you know Mystr- uses Firebird? He could be using Opera, which is still more secure than Internet Explorer.

Let's face it-- IE wasn't written with too much concern with security, like in this case, when IE's developers didn't think that a malicious person could put a null character in the address bar while Mozilla/Firebird/Opera developers did (except for a small exception in which the address bar is spoofed in Mozilla but still not in the *address bar* which most people look at to see if they're at ebay.com.)

And software can still be designed and be secure even when a majority of the market uses it-- even though it's a different product, Apache still illustrates that a dominant product can be secure enough without earth-shattering vulnerabilities.

Last edited by 20554 on 03 Feb 2004 - 03:55

#6.8 SomeDork on 03 Feb 2004 - 04:19

I'm not sensitive. I see realistic. I see 8 patches in the last year for IE. Hell, I'll stack that up to any other browser out there.

And I never said anyone used Firebird unless I was either being hypothetical or responding to someone specifically about Firebird. I'm willing to compare point for point on the security and bugginess of any browser vs IE, but the only counterpoint ever provided is "omg x/y/z browser has more features therefore IE suxors."

Right.

#6.9 markjensen on 03 Feb 2004 - 04:54

Gentlemen...

The first thing that must be realized is that Microsoft and the Open Source community have completely different approaches.

Microsoft tends to bunch up their updates/patches/whatever-you-wanna-call-them into periodic updates with more time between them.

Open Source uses an extremely frequent update process. Daily is not unheard of, especially in popular, active applications.

Neither approach lends itself more or less to security in any grand way. Comparing release schedules is meaningless. One thing I was sure was going to happen when Microsoft announced a monthly update schedule was Microsoft (or others) would start saying "Look! We only had 6 updates last year". While it is certainly a fact, it does little to show which product is superior.

Open Source updates may be more frequent, which is nice for new features, and for bug fixes. But changes to code (in OSS and in MS) can bring about new bugs that weren't anticipated.

So, please bash each other about the head and neck with features and problems, not with the number of updates.

#6.10 markjensen on 03 Feb 2004 - 05:19

QUOTE (#6.10)

And MS didn't start the process of bunching up updates until the last few months (about 3). Until then, the most you could've said was "they just didn't release them".

I thought they had these huge things called "Service Packs", and they contained many different fixes and improvements.

Microsoft just doesn't release fixes for the little things one at a time, and let the user pick what to install and what is not needed/desired.

It was Service Pack, or no Service Pack.

#6.11 SomeDork on 03 Feb 2004 - 05:26

Most patches we're referring to have been security or bugfix vulnerabilities. Service packs are nothing more than the compilation of those, with little exception until recently with the upcoming SP2/XP. Other than that I've been referring to vulnerability hotfix patches like MS04-004 or somesuch which according to a now 3 month practice are bundled into monthly deployments instead of ad-hoc deployments, especially when the vulnerability or exposure levels are minimized by waiting.

Service packs are a totally different concept than hotfix/bugfix/security patch. I'm only referring to the latter. This actually benefits the argument because I'm not even remotely implying "oh look, IE only has one patch: SP1!" Or only one "patch", etc.

(2 replies) #7 kiddingguy on 02 Feb 2004 - 18:53

So, when reinstalling and/or making a clean-install of Win XP, the total download-package (around 100 MB (!)) will still be the same.

Buttah.... when's SP2 actually scheduled. I wanna do a reinstall of my system - first Win XP than SP2 - and afterwards all my proggies.
Since I don't think it's a good idea, stability-wise speaking, of reinstalling Windows and all my apps and THAN SP2

#7.1 Skyfrog on 02 Feb 2004 - 19:18

Personally I would recommend you slipstream SP2 instead of installing it later.

#7.2 leebobs on 02 Feb 2004 - 20:08

Yeah wack SP2 onto the original CD and save yourself the bother!

#8 rseiler on 02 Feb 2004 - 19:22

kid, SP2 is not due until mid-year. And as Sky said, once it's out, make a slipstream and install from that, as opposed to upgrading stock XP with it post-installation.

(3 replies) #9 SSRules on 02 Feb 2004 - 19:43

hmm this update does'nt show in add/remove panel..wonder if I have to reboot to make it show?

#9.1 Skyfrog on 02 Feb 2004 - 21:21

It shows up on mine. Look for "Internet Explorer Q832894".

As for rebooting, you should do that anyway.

#9.2 gameguy on 02 Feb 2004 - 21:34

you shouldn't have to reboot if IE is closed when the update is performed. use automatic updates to install it, close IE before it starts, and install. you should be updated when the install is complete, no need for a reboot, even though it will recommend one anyway.

#9.3 JaggedFlame on 03 Feb 2004 - 13:48

I had to reboot for the username:site@password thing to stop working.

(9 replies) #10 stezo2k on 02 Feb 2004 - 20:02

IE is full of security holes anyway.... they might aswell quit making patches

thank god for firebird

#10.1 [Dan] on 02 Feb 2004 - 20:09

Wish people like you would STFU

#10.2 stezo2k on 02 Feb 2004 - 21:23

well if you aint concerned about your safety on the net, it wouldn't suprise me if you were hacked etc.... i'm only looking out for people

#10.3 mrmumbles on 02 Feb 2004 - 21:41

i think he is more talking about the never ending posts saying firebird is better than IE. its getting like the old, macs are better than pc's argument and vice versa.

#10.4 stezo2k on 02 Feb 2004 - 21:54

i guess you are right but there is no need to be nasty about it

#10.5 SomeDork on 02 Feb 2004 - 23:54

Yes we all know firebird has more features, but you firebird people have completely and utterly failed to convince anyone (except yourselves, perhaps) that it actually has less holes, is less buggy, has less patches, and is more stable and extensible.

Yes, we're tired of the bull "salesmanship" ... if you want to prove a point I'm sure that we'll listen but there's not a point to prove, imho.

I'll just turn your statement around: "Firebird is full of bugs, instabilities, and security flaws, and isn't even a full 1.0 product yet. They might as well never finish the product." Touche?

#10.6 Explicative on 03 Feb 2004 - 05:56

SomeDork misses the point. It doesn't matter which software program is more susceptible to security breaches *in theory*. *In theory* any given software program is more vulnerable to attack than another, given a sufficiently creative hacker. The fact of the matter is that by virtue of Firebird's being a lesser-known, lesser-used browser, hackers aren't spending time creating and releasing exploits for it, they're doing it for IE. The same point stands for OSX vs. Windows.

#10.7 SomeDork on 03 Feb 2004 - 06:13

Burglars rob banks, therefore I need no locks on my doors, right? That would be your logic. Should only the best most sold car on the market have seat belts because more people use it? There are vulnerabilities and exploits that exist in other environments; whether they are exploited or not, is irrelevent, whether they are most used is irrelevent, and whether or not they are targetted is irrelevent.

Explicative, you're utilizing a very very lazy argument. When one party is complaining about quality, you can't immediately take the side of "well, we don't need to adhere to the same standards we're debasing in your product." It doesn't go both ways.

#10.8 stezo2k on 03 Feb 2004 - 07:59

smart reply

as for the burgulars rob banks, i agree partly, but vunrabilities in IE still can cause problems, like trojans etc... and i'm sure people don't want that, i like to feel secure online thats all

#10.9 LastSamurai on 03 Feb 2004 - 11:31

So u would not STFU

#11 Sushubh on 02 Feb 2004 - 20:42

is it safe to install this patch?

#12 Gumboot on 02 Feb 2004 - 21:33

This patch finally fixes the URL spoofing bug!

And it disables support for http://user@domain as mentioned on Neowin a few days ago.

#13 chaos945 on 02 Feb 2004 - 21:58

Don't know about you guys but the link was fubared for me, here is another.

Mirror Official Homepage

#14 Mister Lamar on 02 Feb 2004 - 21:58

Internet Explorer

update installed and still using it with no problems

(4 replies) #15 HoriZon-UK on 02 Feb 2004 - 22:04

They also fixed the scrolling bugs, highlight text now remains and the scroll bar seems to be fixed as well!

Only 3 months later!

http://secunia.com/Internet_Explorer_File_Download_Extension_Spoofing_Test/

Thats not fixed though, thought it was to be ??

------------

As for this one I get a blank page now or a Invalid syntax error, this is how its meant to be no?

http://www.secunia.com/internet_explorer_address_bar_spoofing_test/

#15.1 Geo on 03 Feb 2004 - 02:26

wow, three months!, thats friggen fast. they must of cut back on solitare tournaments during work

#15.2 OptiPlex on 03 Feb 2004 - 02:29

You'll have to wait for the next patch for that fix.
Hopefully some random open source website won't try to fix it

#15.3 markjensen on 03 Feb 2004 - 04:58

Hopefully some random open source website won't try to fix it

LMAO!

But, just for the record, the place that did a miserable job was "Open Wares" or 'Warez'... they are not an Open Source group, just a bunch of h4x0rz that thought they would be cool.

Still, a funny quote!

#15.4 OptiPlex on 04 Feb 2004 - 00:40

Ah dang my memory's fuzzy

(1 reply) #16 SomeDork on 03 Feb 2004 - 05:17

The debate isn't about what is superior, it's about which product is "less buggy" at its best, it's hard to tell with all the quips about feature sets being different/better.

And MS didn't start the process of bunching up updates until the last few months (about 3). Until then, the most you could've said was "they just didn't release them".

Even with bundling, I'm willing to compare based upon listed vulnerabilities, not even released patches (bundled or not, this would be an equitable comparison). Yet noone is willing to step up to the plate.

#16.1 mcloum on 03 Feb 2004 - 13:34

personally i think Firebird is buggier as its still only beta. But i prefer Firebird over IE

#17 BrY on 03 Feb 2004 - 05:20

This update has wiped out all my username/password for websites with a dialog box popup, oh gosh.... some of these are not recoverable sadly.

#18 carlito on 03 Feb 2004 - 05:29

I get an error trying to install saying something about cant find BROWSEUI.DLL

#19 DsnBehind on 03 Feb 2004 - 07:24

Yay!

/me *hugs* Internet Explorer and *kicks* Firebird fanatics away.

(1 reply) #20 SouL2kEEp on 03 Feb 2004 - 08:12

does anyone know why i get "IE6 SP1 Required" error when im installing this?
(yes i have SP1 installed)

#20.1 OptiPlex on 04 Feb 2004 - 00:41

Version conflict. I can't help you beyond this. Try repair?

(1 reply) #21 warr on 03 Feb 2004 - 08:19

IE users got f@cked.

#21.1 LastSamurai on 03 Feb 2004 - 11:24

and you just fuked yourself.
you enjoy being an ass, dont ya

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net