SANS-Internet Storm Center
More MS06-042 woes
August 22nd 2006
Handler’s Diary
The hotfix for MS06-042, which was supposed to be released today, has been delayed. Worse: It turns out that MS06-042 introduced a new security problem. The crashes everyone is having so much fun with are just the tip of the iceberg. The issue can also be used to execute arbitrary code.
eEye
MS06-042 Related Internet Explorer ‘Crash’ is Exploitable
Date: August 22, 2006
Security Alerts | AL20060822
Severity: Critical
Systems Affected:
Windows 2000 with IE6 SP1 and MS06-042 hotfix installed
Windows XP SP1 with IE6 SP1 and MS06-042 hotfix installedOverview:
On August 8th Microsoft released MS06-042 which was a
cumulative update for Internet Explorer. Over the course of a few days after the release of this patch various Internet Explorer users and businesses started to experience Internet Explorer crashing problems when viewing certain websites.
Because of the widespread discussions and number of people experiencing the Internet Explorer crash various security researchers, including eEye, decided to investigate as a lot of times crashes can be exploitable.
Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)
Published: August 8, 2006 | Updated: August 22, 2006
Caveats: For some Internet Explorer 6.0 Service Pack 1 users, Internet Explorer may exit unexpectedly while attempting to access Web Sites using both the HTTP 1.1 protocol and compression. A hotfix and workaround for this issue is available, please see Knowledge Base Article 923762 for more information. On August 15, 2006 Microsoft announced that it would be re-releasing MS06-042 Tuesday, August 22, 2006 to address an issue affecting Internet Explorer 6 Service Pack 1 customers discussed in Microsoft Knowledge Base Article 923762. Due to an issue discovered in final testing, Microsoft will not be re-releasing MS06-042 on August 22nd, 2006. This update will be re-released for Internet Explorer 6 Service Pack 1 when it meets an appropriate level of quality for broad distribution.
Comments on this entry are closed.