MinorRev: Microsoft Security Bulletin MS04-004 - Cumulative Security Update for Internet Explorer (832894)

From: Russ (Russ.Cooper_at_RC.ON.CA)
Date: 02/10/04

  • Next message: Russ: "Alert: Microsoft Security Bulletin MS04-005 - Vulnerability in Virtual PC for Mac could lead to privilege elevation (835150)" 
    Date:         Tue, 10 Feb 2004 14:06:26 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Reason for Revision:
    V1.4 February 9, 2004: Updated the Caveats, Technical Details and
    Frequently Asked Question section with information regarding changes to
    Internet Explorer's protect store. Switched file version and name
    columns for pngfilt.dll in Internet Explorer 5.01 SP2 section of
    Security Update Information.

    Microsoft Security Bulletin MS04-004:
    Cumulative Security Update for Internet Explorer (832894)

    Bulletin URL:
    http://www.microsoft.com/technet/security/bulletin/MS04-004.asp

    Summary:
     Version Number: V1.4
     Revision Date: 02-09-2004
     Impact of Vulnerability: Remote Code Execution
     Maximum Severity Rating: Critical
     Patch(es) Replaced: This update replaces the one that is provided in
    Microsoft Security Bulletin MS03-048, which is itself a cumulative
    update.
     Caveats: Installing this Security Update will invalidate the usernames
    and passwords stored in Internet Explorer's protected store. This will
    require users to re-enter their username and password when they first
    visit web sites that require authentication.
     CVE Number(s): CAN-2003-1026,CAN-2003-1027,CAN-2003-1025

    Tested Software:
     Affected Software:
     * Microsoft Windows NT(r) Workstation 4.0 Service Pack 6a
     * Microsoft Windows NT Server 4.0 Service Pack 6a
     * Microsoft Windows NT Server 4.0 Terminal Server Edition, Service Pack
    6
     * Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4
     * Microsoft Windows XP, Microsoft Windows XP Service Pack 1
     * Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit
    Edition Service Pack 1
     * Microsoft Windows XP 64-Bit Edition Version 2003
     * Microsoft Windows Server(r) 2003
     * Microsoft Windows Server 2003, 64-Bit Edition
     * Internet Explorer 6 Service Pack 1: Download the update.
     * Internet Explorer 6 Service Pack 1 (64-Bit Edition): Download the
    update.
     * Internet Explorer 6 for Windows Server 2003: Download the update.
     * Internet Explorer 6 for Windows Server 2003 (64-Bit Edition):
    Download the update.
     * Internet Explorer 6: Download the update.
     * Internet Explorer 5.5 Service Pack 2: Download the update.
     * Internet Explorer 5.01 Service Pack 4: Download the update.
     * Internet Explorer 5.01 Service Pack 3: Download the update.
     * Internet Explorer 5.01 Service Pack 2: Download the update.

     Affected Components:
     * Internet Explorer 6 Service Pack 1
    <http://www.ntbugtraq.com/link/70530968-B59A-47C0-90D3-0C884910BC97.asp>
     * Internet Explorer 6 Service Pack 1 (64-Bit Edition)
    <http://www.ntbugtraq.com/link/326EFFDA-8D86-4683-BC77-9BF410BC620D.asp>
     * Internet Explorer 6 for Windows Server 2003
    <http://www.ntbugtraq.com/link/D78AE4F7-8852-4A04-B8F6-1DE327E598F0.asp>
     * Internet Explorer 6 for Windows Server 2003 (64-Bit Edition)
    <http://www.ntbugtraq.com/link/6A7894F0-789F-4152-9AE4-8DCB43404149.asp>
     * Internet Explorer 6
    <http://www.ntbugtraq.com/link/BE0C18BC-7F9A-4196-BFDE-29EBA8CF7A50.asp>
     * Internet Explorer 5.5 Service Pack 2
    <http://www.ntbugtraq.com/link/EFFE87F6-7ACA-4A54-B767-5597DDE95C6F.asp>
     * Internet Explorer 5.01 Service Pack 4
    <http://www.ntbugtraq.com/link/F5E74139-6E0E-49FD-9AA2-36D2D8454A92.asp>
     * Internet Explorer 5.01 Service Pack 3
    <http://www.ntbugtraq.com/link/202D3AAC-6B56-4F4A-8C0F-4183C77B6B51.asp>
     * Internet Explorer 5.01 Service Pack 2
    <http://www.ntbugtraq.com/link/17904608-DCEE-4C99-A780-81D6DBC48DD5.asp>

     Software Not Affected:

    This email is sent to NTBugtraq automagically as a service to my
    subscribers. (v2.3)

    Cheers,
    Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

    -----
    NTBugtraq Editor's Note:

    Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
    -----

  • Next message: Russ: "Alert: Microsoft Security Bulletin MS04-005 - Vulnerability in Virtual PC for Mac could lead to privilege elevation (835150)"

    Relevant Pages