I decided to publish this security bulletin, which I received from Panda this morning:
Quote:
- Cumulative patches for Internet Explorer and Outlook Express -
Oxygen3 24h-365d, by Panda Software ( http://www.pandasoftware.com )
Madrid, April 24, 2003 - Microsoft has published two bulletins warning of
four vulnerabilities in Internet Explorer and one in Outlook Express, and
has informed that the patches that fix them are available for download.
In Internet Explorer, the security flaws affect versions 5.01, 5.5 and 6.0
of the program. The most serious of these vulnerabilities could allow an
attacker to run arbitrary code on the targeted user's machine by taking
advantage of a buffer overrun in URLMON.DLL. The second flaw could be
exploited by a hacker to run a script on the system, while the last two
could be used to gain access to information.
The flaw found in Outlook Express affects versions 5.5 and 6.0 and lies in
the handling of MHTML addresses (MHTML://), an Internet standard used to
define the MIME(*) structure that e-mails in HTML format should have. This
vulnerability could allow an attacker to run code on the affected user's
system. To do this, the hacker must cause Windows to open a specially
crafted MHTML URL, which is included in a website or in an HTML e-mail.
The bulletins published by Microsoft with information on the vulnerabilities
above and the addresses for the corresponding security patches are available
at:
http://www.microsoft.com/technet/securi ... 03-014.asp and
http://www.microsoft.com/technet/securi ... 03-015.asp
(*)MIME (Multipurpose Internet Mail Extensions): This is the set of
specifications that allows text and files with different character sets to
be exchanged over the Internet (e.g. between computers in different
languages).
End of quote.
Regards to you all.
Gregor
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02 (DJGM-i.net)
