Microsoft battles old, new security holes with IE patch

Microsoft issued a security patch Monday that fixes six holes in its Internet Explorer Web browser, just as a nasty Internet worm that threatens to overwrite certain PC files continued its assault on users.

The "cumulative" patch made available for download Monday fixes holes in versions 5.01, 5.5 and 6.0 of Internet Explorer. It addresses six vulnerabilities discovered in the past few months, one of which could allow a malicious hacker to run code on another user's computer, Microsoft said. Microsoft gave the vulnerabilities a "critical" rating, and advised users to download the patch from its Web site immediately.

One of the holes could disguise the name of a file posted on a Web site so that a user might be tricked into opening or saving the file without knowing it is unsafe. Other vulnerabilities could allow an attacker to run code or view certain files on a user's PC, or run a script even when the user has disabled scripting, Microsoft said.

The patch and a technical description of the flaws are on Microsoft's Web site at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-005.asp/.

In addition, the cumulative patch includes a handful of previously released fixes for other holes found in the browser. One of those fixes is designed to block a worm known as "Klez," which has threatened some Internet Explorer users since it first circulated via e-mail in October.

Several variants of the Klez worm have emerged, including a recent one known as "Klez.e," which poses the most serious threat, according to Kaspersky Labs Ltd., a security research company based in Moscow. Last week, Kaspersky Labs released a software tool designed to detect and delete the Klez.e worm from infected computers.

Klez.e affects Internet Explorer versions 5.01 and 5.5, and strikes at a vulnerability in the Web browser first identified in March of last year. "This is a relatively old vulnerability," said Vincent Weafer, senior director of the security response team at security software company Symantec Corp. Microsoft has issued patches for that hole in the past.

Klez.e can automatically launch itself when a user views an e-mail infected with the worm. Those e-mails use one of 20 words or phrases in the subject line, and contain either no text or random text in the body of the message, Kaspersky said. The words and phrases are listed on Kapsersky's Web site.

If a user opens an infected e-mail in Outlook or Outlook Express the worm tries to redirect itself as an email attachment to everyone listed in the user's address book. It also attempts to overwrite certain PC files including text, HTML and MPEG files.

More threatening, Klez.e is triggered to overwrite all the files on a user's computer on the sixth day of every odd-numbered month, with the next "hot date" being March 6.

The worm also tries to disable antivirus software on a user's PC, though Symantec said its Norton Antivirus tools are protected. For antivirus programs that remain susceptible, the worm could render the user interface unviewable or interfere with the "real-time scanner" which searches for viruses.

The same vulnerability in Internet Explorer that allows for Klez.e to do its harm was partly responsible for the Nimda virus that emerged last year, Weafer said. "We've had other worms in the past that exploited the same vulnerability," he said.

Symantec has received about 1,000 notifications of Klez.e from home and corporate users since Jan. 18, when the harmful variant surfaced. Those submissions have now "leveled off," Weafer said, but Symantec still regards the worm as a "moderate" threat. By comparison, the company has received about 5,000 submissions of the Magistr worm and about 8,000 submissions of the Badtrans worm, he said.

Klez.e was among the top 10 most frequently occurring viruses this month, according to antivirus protection company Sophos Inc., in Wakefield, Massachusetts.

Kapersky Lab's tool for detecting the Klez.e worm, and a list of the 20 words and phrases that appear in the subject line of infected emails, are on its Web site at http://www.kaspersky.com/news.html?tnews=20140&id=224578/.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Matt Berger

PC World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?