Doubts raised over Microsoft patches

Zardon · Nov 25, 2002, 11:40 PM

Danish firm finds flaws in security fixes
Security patches released by Microsoft last week may not completely protect users, according to a Danish security consultancy.
Microsoft security alert 65 and alert 66 deal with the Windows operating system and Internet Explorer, and are rated 'critical' and 'important' respectively.

Alert 66, a bundled software patch for Internet Explorer versions five and six, is aimed at fixing six specific faults in the browser.

Simon Conant, of Microsoft product support services, said: "If users update with this patch they will be covered for all the currently known security flaws.

"They'll still need to use patch 65 as well as that's not a specific Internet Explorer patch but can affect the software."

But Danish security company Secunia said it has identified flaws with both patches.

Microsoft has admitted patch 65 may not be fully effective in certain circumstances, but it has made no mention of problems with patch 66.

Although patch 65 does offer a broad solution it is still vulnerable to malicious websites and HTML emails. If the browser downloads ActiveX controls automatically it might be possible to reintroduce malicious code.

The software giant has suggested that users remove its software from the Trusted Publisher list and check the software's origin before downloading.

Part of the flaw in patch 66 means it is still possible for a website to run an executable that is stored on a system.

This could allow an outsider to view the contents of a previously identified file and view the clipboard.

Secunia spotted the flaws while installing and checking the patches. Details of how to fix them can be found here.

"I was very shocked at the problems, particularly with alert 65," said Thomas Kristensen, chief technical officer of Secunia.

"We noticed the problems and only then did we find them mentioned in the FAQ. The only way around them is to manually install all digital certificates after checking their veracity, and who wants to do that?" he said.

Microsoft could not provide a comment on Secunia's discoveries by the time of going to press.

Nov 25, 2002, 11:40 PM	#1
Zardon DriverHeaven Founder Join Date: May 2002 Posts: 32,480 Rep Power: 179	Doubts raised over Microsoft patches Danish firm finds flaws in security fixes Security patches released by Microsoft last week may not completely protect users, according to a Danish security consultancy. Microsoft security alert 65 and alert 66 deal with the Windows operating system and Internet Explorer, and are rated 'critical' and 'important' respectively. Alert 66, a bundled software patch for Internet Explorer versions five and six, is aimed at fixing six specific faults in the browser. Simon Conant, of Microsoft product support services, said: "If users update with this patch they will be covered for all the currently known security flaws. "They'll still need to use patch 65 as well as that's not a specific Internet Explorer patch but can affect the software." But Danish security company Secunia said it has identified flaws with both patches. Microsoft has admitted patch 65 may not be fully effective in certain circumstances, but it has made no mention of problems with patch 66. Although patch 65 does offer a broad solution it is still vulnerable to malicious websites and HTML emails. If the browser downloads ActiveX controls automatically it might be possible to reintroduce malicious code. The software giant has suggested that users remove its software from the Trusted Publisher list and check the software's origin before downloading. Part of the flaw in patch 66 means it is still possible for a website to run an executable that is stored on a system. This could allow an outsider to view the contents of a previously identified file and view the clipboard. Secunia spotted the flaws while installing and checking the patches. Details of how to fix them can be found here. "I was very shocked at the problems, particularly with alert 65," said Thomas Kristensen, chief technical officer of Secunia. "We noticed the problems and only then did we find them mentioned in the FAQ. The only way around them is to manually install all digital certificates after checking their veracity, and who wants to do that?" he said. Microsoft could not provide a comment on Secunia's discoveries by the time of going to press.