The Channel logo


By | John Leyden 14th December 2005 11:29

MS releases IE überpatch

Brace for impact

Microsoft released a pair of patches on Tuesday - including a cumulative security fix for IE deemed "critical" - as part of its regular monthly patching schedule. The IE update (MS05-054) deals with four security vulnerabilities including two flaws which create a means for ne'er do wells to run hostile code on vulnerable systems, including one that has become the subject of a hacker-friendly exploit. All Windows users with all supported flavours of IE are urged to apply the update.

The browser uber-patch also deals with the fallout from Sony BMG's controversial use of flawed digital rights management software (First4Internet's XCP program). The browser update makes it impossible to run First4Internet XCP uninstallation ActiveX control, a piece of code designed to remove the DRM software but which was found to create worse security problems than it attempted to solve.

Microsoft also released a patch to address a privilege-elevation flaw in Windows 2000 (MS05-055). Attacks based on the vulnerability would need local access to vulnerable machines, however it's still serious enough to be described as an "important" security update. The flaw was discovered by security firm eEye on May 23 - 204 days ago - and involves a locally exploitable kernel-level vulnerability. "Although not remotely exploitable in-and-of itself, a malicious user, network worm or email virus could take advantage of this vulnerability in order to completely compromise a vulnerable system on which the exploit code is executing, regardless of that code's original privilege level," eEye notes. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe