2 min read

Microsoft Sparks Backlash By Tying Internet Explorer Changes To Security Patch

Security vendors say the security patch that Microsoft
"To help enterprise customers who need more time to prepare for the update, Microsoft is releasing a Compatibility Patch," said the company spokesman.

If enterprises follow Microsoft's advice -- deploy MS06-013 and its ActiveX changes first, then follow up by installing the compatibility patch -- they'll be faced with a secure, but possibly-broken browser, at least temporarily, said nCircle's Murray.

To compound the problem, it's crucial that companies deploy the IE security fixes in MS06-013 ASAP, another security vendor said Wednesday.

In an alert to users of its DeepSight Threat Management System, Symantec advised enterprises to either update or consider dropping IE.

"The DeepSight team strongly encourages system administrators to apply the fixes in this update as soon as possible," the alert read.

The large number of vulnerabilities covered by the bulletin precludes any finesse in mitigating against attack, Symantec concluded, and instead recommended that one option for companies unable to install the fixes is to "disable Internet Explorer until patches can be rolled out." Other advice included setting the browser's security settings to "High" and/or restricting browsing to corporate intranet and other trusted sites.

Symantec and other security companies raised the alert in part because 3 of the 7 critical flaws described in the bulletin are either currently being exploited or have been the target of published proof-of-concept code.

The "createTextRange" vulnerability, now patched, has been used by hundreds of Web sites for three weeks to secretly download spyware, adware, and other malicious programs to IE users' machines.

The createTextRange bug, in fact, was thought serious enough to generate a pair of unsanctioned, third-party patches weeks before Microsoft released its fix. One of those patches was created and distributed free of charge by Aliso Viejo, Calif.-based eEye Digital Security, which on Tuesday announced that more than 150,000 people had downloaded the patch in the two weeks it was available.

"Disabling Active Scripting [a workaround suggested by Microsoft] and waiting 14 days for Microsoft to issue a patch was not a viable option for many organizations," said eEye's co-founder Mark Maiffret in a statement. "This vulnerability needed to be dealt with immediately."

Details on the fixes applied in the MS06-013 patches can be found here, while the ActiveX delay patch can be downloaded for Windows XP and Windows Server 2003 from here.

Editor's Choice
Sara Peters, Editor-in-Chief, InformationWeek / Network Computing
Pam Baker, Contributing Writer
James M. Connolly, Contributing Editor and Writer
Sara Peters, Editor-in-Chief, InformationWeek / Network Computing
Greg Douglass, Global Lead for Technology Strategy & Advisory, Accenture
Carrie Pallardy, Contributing Reporter