Microsoft released IE security update for VML flaw - MS07-05

Microsoft released an update to a 2007 Internet Explorer patch covering IE5.01, IE6 and IE7. The update comes as Redmond issued Internet Explorer 8 Beta 2. It follows the company's cumulative general security patch release for August, which included critical fixes for Microsoft's browser application. The software giant says this latest IE security update, which was published […]

Microsoft released an update to a 2007 Internet Explorer patch covering IE5.01, IE6 and IE7. The update comes as Redmond issued Internet Explorer 8 Beta 2. It follows the company's cumulative general security patch release for August, which included critical fixes for Microsoft's browser application.

The software giant says this latest IE security update, which was published on Wednesday, “resolves a privately reported vulnerability” in the Vector Markup Language (VML) implementation in Windows. The main purpose of VML is to allow servers to communicate with one another and share structured data, particularly via the Web.

The patch, first released in August 2007, was designed to stave off remote code execution (RCE) exploits. RCE attacks occur when an end user or administrator opens up a maliciously crafted Web page or Hypertext Markup Language file.

The updated IE patch addresses the kill bit for ActiveX controls, as well as the way certain strings in cascading style sheet (CSS) files are configured and aggregated for Web publishing.

The patch applies to IE 5.01 and IE 6 Service Pack 1, and Windows XP Home and Professional Editions, but Microsoft added a fix for the latest version of IE 7 with this update. Microsoft suggests that IT pros and users with the applicable version of IE install the patch immediately.

Security experts mainly see this rerelease as routine. However, it's important for Microsoft to have all of its ducks in a row ahead of its much-heralded IE release, especially when the company banks on having improved security in Internet Explorer. Microsoft has not officially announced a release date for the non-beta version of Internet Explorer 8.

Download

Source:→ ENT Magazine