From: Russ (Russ.CooperRC.ON.CA)
Date: Tue Feb 10 2004 - 13:06:26 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Reason for Revision:
V1.4 February 9, 2004: Updated the Caveats, Technical Details and
Frequently Asked Question section with information regarding changes to
Internet Explorer's protect store. Switched file version and name
columns for pngfilt.dll in Internet Explorer 5.01 SP2 section of
Security Update Information.

Microsoft Security Bulletin MS04-004:
Cumulative Security Update for Internet Explorer (832894)

Bulletin URL:
http://www.microsoft.com/technet/security/bulletin/MS04-004.asp

Summary:
 Version Number: V1.4
 Revision Date: 02-09-2004
 Impact of Vulnerability: Remote Code Execution
 Maximum Severity Rating: Critical
 Patch(es) Replaced: This update replaces the one that is provided in
Microsoft Security Bulletin MS03-048, which is itself a cumulative
update.
 Caveats: Installing this Security Update will invalidate the usernames
and passwords stored in Internet Explorer's protected store. This will
require users to re-enter their username and password when they first
visit web sites that require authentication.
 CVE Number(s): CAN-2003-1026,CAN-2003-1027,CAN-2003-1025

Tested Software:
 Affected Software:
 * Microsoft Windows NT(r) Workstation 4.0 Service Pack 6a
 * Microsoft Windows NT Server 4.0 Service Pack 6a
 * Microsoft Windows NT Server 4.0 Terminal Server Edition, Service Pack
6
 * Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
 * Microsoft Windows XP, Microsoft Windows XP Service Pack 1
 * Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit
Edition Service Pack 1
 * Microsoft Windows XP 64-Bit Edition Version 2003
 * Microsoft Windows Server(r) 2003
 * Microsoft Windows Server 2003, 64-Bit Edition
 * Internet Explorer 6 Service Pack 1: Download the update.
 * Internet Explorer 6 Service Pack 1 (64-Bit Edition): Download the
update.
 * Internet Explorer 6 for Windows Server 2003: Download the update.
 * Internet Explorer 6 for Windows Server 2003 (64-Bit Edition):
Download the update.
 * Internet Explorer 6: Download the update.
 * Internet Explorer 5.5 Service Pack 2: Download the update.
 * Internet Explorer 5.01 Service Pack 4: Download the update.
 * Internet Explorer 5.01 Service Pack 3: Download the update.
 * Internet Explorer 5.01 Service Pack 2: Download the update.

 Affected Components:
 * Internet Explorer 6 Service Pack 1
<http://www.ntbugtraq.com/link/70530968-B59A-47C0-90D3-0C884910BC97.asp>
 * Internet Explorer 6 Service Pack 1 (64-Bit Edition)
<http://www.ntbugtraq.com/link/326EFFDA-8D86-4683-BC77-9BF410BC620D.asp>
 * Internet Explorer 6 for Windows Server 2003
<http://www.ntbugtraq.com/link/D78AE4F7-8852-4A04-B8F6-1DE327E598F0.asp>
 * Internet Explorer 6 for Windows Server 2003 (64-Bit Edition)
<http://www.ntbugtraq.com/link/6A7894F0-789F-4152-9AE4-8DCB43404149.asp>
 * Internet Explorer 6
<http://www.ntbugtraq.com/link/BE0C18BC-7F9A-4196-BFDE-29EBA8CF7A50.asp>
 * Internet Explorer 5.5 Service Pack 2
<http://www.ntbugtraq.com/link/EFFE87F6-7ACA-4A54-B767-5597DDE95C6F.asp>
 * Internet Explorer 5.01 Service Pack 4
<http://www.ntbugtraq.com/link/F5E74139-6E0E-49FD-9AA2-36D2D8454A92.asp>
 * Internet Explorer 5.01 Service Pack 3
<http://www.ntbugtraq.com/link/202D3AAC-6B56-4F4A-8C0F-4183C77B6B51.asp>
 * Internet Explorer 5.01 Service Pack 2
<http://www.ntbugtraq.com/link/17904608-DCEE-4C99-A780-81D6DBC48DD5.asp>

 Software Not Affected:

This email is sent to NTBugtraq automagically as a service to my
subscribers. (v2.3)

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

-----
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]