The most serious problem, known as a cross-domain security vulnerability, affects all versions of Internet Explorer running on Windows NT, 2000 and XP. A person with a vulnerable system who clicks on a link in an HTML e-mail or goes to a hostile Web site could allow an attacker to run code on their computer, Microsoft said in its advisory.
What's new:
Microsoft issues a fix to a critical flaw in Internet Explorer that could allow malicious coders to take control of an unwary user's PC.
Bottom line:
The company broke from its regular pattern of using fixes monthly because of the seriousness of a flaw: a person with a vulnerable system who clicks on a link in an HTML e-mail or goes to a hostile Web site could allow an attacker to run code on their computer.
For more info:
Track the players
The seriousness of the issue forced the company to release the latest fixes before its normally scheduled date, the second Tuesday of the month.
"We evaluated the public nature of the vulnerabilities and heard from customers that this was impacting them, and we made the decision to publish," said Stephen Toulouse, security program manager with Microsoft's Security Response Center.
The update also fixes two other security flaws, including one that gained a lot of attention for its ability to make fake Web sites look real. Known as the phishing flaw, the problem allows scam artists to forge the address in the Internet Explorer browser's address bar to display an address different from the actual site to which the user was being sent.
Scammers typically use the flaw to build a site that looks like an official Web site and then send bulk e-mail messages that draw unsuspecting victims to the site. In January, the scam directed users to a site that looked like the official Federal Deposit Insurance Corp. Web site, asking for personal information to verify their identity. Instead, the fake Web site, based in Pakistan, collected the information in an attempt to steal from victims.
A third flaw allows a malicious Web site or HTML e-mail to download a file to a user's computer, without asking permission, when the user clicks on a specially crafted link.
 | ||||
|
| | ||
|
Get Up to Speed on... Enterprise security  Get the latest headlines and company-specific news in our expanded GUTS section. |
| ||
|
|
||||
|
|
||||
Microsoft advised Windows users to update their software quickly.
Breaking from Microsoft's monthly patch schedule will not happen often, said Toulouse.
"We do believe very much in sticking to the once-a-month thing--our customers like the predictability," he said. "But we have always said that if we have to go out of the cycle to protect our customers we would do that."
(NT)
