This security update is being released out of band in conjunction with Microsoft Security Bulletin MS09-035, which describes vulnerabilities in those components and controls that have been developed using vulnerable versions of the Microsoft Active Template Library (ATL). As a defense-in-depth measure, this Internet Explorer security update helps mitigate known attack vectors within Internet Explorer for those components and controls that have been developed with vulnerable versions of ATL as described in Microsoft Security Advisory (973882) and Microsoft Security Bulletin MS09-035.

This security update also resolves three privately reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 5.01 and Internet Explorer 6 Service Pack 1, running on supported editions of Microsoft Windows 2000; Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 running on supported editions of Windows XP; Critical for Internet Explorer 7 and Internet Explorer 8 running on supported editions of Windows Vista; Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 running on supported editions of Windows Server 2003; and Moderate for Internet Explorer 7 and Internet Explorer 8 running on supported editions of Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

Windows users should make sure to download the security update as soon as possible. It is available at the usual sources including automatic updates, Windows Update or Microsoft Update.

Related posts

• Real Player Internet Explorer vulnerability (2)
• Microsoft’s Internet Explorer Comparison Chart (23)
• Microsoft February Security Updates (4)
• Log Into Multiple Accounts At The Same Site With Internet Explorer 8 (9)
• Internet Explorer Vulnerability Fix (5)

The security vulnerability affects only Windows XP and Windows Server 2003 systems. Computer systems running Windows Vista, Windows Server 2008 or Windows 7 are not affected because “the ability to pass data to this control within Internet Explorer” is restricted in these operating systems.

A successful attack will give the attacker the same user rights as the currently logged in user. Microsoft has issued a workaround for the Internet Explorer vulnerability that can be applied manually or using Microsoft Fix It.

The fastest way to patch the security vulnerability is to use the Microsoft Fix It script that will perform all the actions of the workaround automatically. The fix will basically remove support for the ActiveX Control in Internet Explorer. This should not have any impact on the web browser’s functionality according to Microsoft.

Related posts

• Microsoft Internet Explorer Security Update (3)
• Real Player Internet Explorer vulnerability (2)
• List Of Microsoft Fix It Solutions (4)
• Internet Explorer Virtual PC Images (1)
• Internet Explorer 8 And 64-bit Windows Fixes (0)

While this works as intended in the 32-bit edition of Windows Vista it does not in the 64-bit edition as it is still possible for users to access Internet Explorer from the Windows start menu. The hotfix corrects the issue so that the function is working as intended on 64-bit editions of Windows Vista as well.

The second problem affects the 64-bit editions of Windows Vista, Windows Server 2003 and Windows Server 2008. Microsoft describes the problem the following way:

The Image Delivery server that runs the 64-bit version of Windows Server 2008 or of Windows Server 2003 stops delivering images when you deploy an operating system by using an image-based installation method

The hotfix can also be downloaded directly by visiting the Microsoft Knowledge Base article.

Related posts

• Windows Vista Service Pack 2 RC Download (6)
• Uninstall Internet Explorer 8 (33)
• Microsoft: IE8 Beta 2 coming ! Is your website ready ? (3)
• Log Into Multiple Accounts At The Same Site With Internet Explorer 8 (9)
• Internet Explorer 8 Final (16)