There are no known "non-patch or upgrade" workarounds for this issue and, as was theĬase in the WMF issue patched by MS06-001, you cannot block WMF images at the border by extension, because IE does not rely on the extension when parsing the file. Server patching isn't as critical because you shouldn't be performing the high-risk tasks (surfing and reading mail) on a server. If, however, you happen to be running an older system that is vulnerable to this issue then patching workstations (in the case of Win2K SP4) or upgrading (in the case of other non-supported versions) is critical. MS suggests moving to IE 6.0 on ME.īecause the installed base of the "currently supported" affected platforms is small, Microsoft isn't viewing this as a critical issue. It also appears that IE 5.5 SP2 on WindowsME is vulnerable and, again, out of support. These may be (or probably are) vulnerable as well. Officially, Microsoft says that this issue only affects Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4, however, since older versions of Win2K and WinNT are now out of support, Outlook and Outlook Express) use IE?s HTML rendering code, it could be embedded in an email.
The image can be on a web page or, because other programs (ie. This patch fixes a WMF image parsing memory corruption vulnerability in Internet Explorer (CVE-2006-0020) in which a specially constructed WMF image can be used to execute code on an affected system with the MS06-004 - Cumulative Security Update for Internet Explorer (910620)
0 kommentar(er)
