News

Microsoft Updates IE Patch Due to VML Flaw

Microsoft this week released an update to a 2007 Internet Explorer patch covering Internet Explorer 5.01, Internet Explorer 6 and Internet Explorer 7.

Microsoft this week released an update to a 2007 Internet Explorer patch covering Internet Explorer 5.01, Internet Explorer 6 and Internet Explorer 7.

The update comes as Redmond issued Internet Explorer 8 Beta 2 this week. It follows the company's cumulative general security patch release for August, which included critical fixes for Microsoft's browser application.

The software giant says this latest IE security update, which was published on Wednesday, "resolves a privately reported vulnerability" in the Vector Markup Language (VML) implementation in Windows. The main purpose of VML is to allow servers to communicate with one another and share structured data, particularly via the Web.

The patch, first released in August 2007, was designed to stave off remote code execution (RCE) exploits. RCE attacks occur when an end user or administrator opens up a maliciously crafted Web page or Hypertext Markup Language file.

The updated IE patch addresses the kill bit for ActiveX controls, as well as the way certain strings in cascading style sheet (CSS) files are configured and aggregated for Web publishing.

The patch applies to IE 5.01 and IE 6 Service Pack 1, and Windows XP Home and Professional Editions, but Microsoft added a fix for the latest version of IE 7 with this update. Microsoft suggests that IT pros and users with the applicable version of IE install the patch immediately.

Security experts mainly see this rerelease as routine. However, it's important for Microsoft to have all of its ducks in a row ahead of its much-heralded IE release, especially when the company banks on having improved security in Internet Explorer. Microsoft has not officially announced a release date for the non-beta version of Internet Explorer 8.

"Overall, unpatched systems and lack of user awareness, coupled with the number of people freely roaming the Internet, makes these [RCE vulnerabilities] more profitable and more easily exploitable than the remote attacks from days-gone-by," said Tyler Reguly, a security engineer for nCircle, a San Francisco-based network security firm. "We're seeing a lot of the same things we've seen in the past in regards to what's being patched as far as IE, and it's as important as ever for [Microsoft]."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Nerdio Hands Microsoft MSPs an Assist with 'Modern Work' Upgrades

    Neridio is rolling out new improvements to its Manager for MSP platform aimed at simplifying partner deployment of multiple Microsoft services, including Azure Virtual Desktop (AVD), Microsoft 365 and Microsoft Intune.

  • Image of a futuristic maze

    The 2024 Microsoft Product Roadmap

    Everything Microsoft partners and IT pros need to know about major Microsoft product milestones this year.

  • Windows Server 2025 Now Generally Available

    Microsoft's next-gen server platform, Windows Server 2025, is now ready for production environments, the company announced Monday.

  • Microsoft Takes Wraps Off 'Modernized' Windows Hello

    Windows 11 users will see a new and improved Windows Hello interface, Microsoft said recently.