DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 306121 - Last Review: February 27, 2014 - Revision: 4.4

This article was previously published under Q306121
This article has been archived. It is offered "as is" and will no longer be updated.

On This Page

SYMPTOMS

A vulnerability exists in Internet Explorer that could allow a Web site to take actions that it should not be able to take when you visit the Web site. Specifically, the vulnerability could allow the Web site to trick Internet Explorer into treating the page as though it were located on your intranet, thereby gaining the ability to use less-restrictive security settings than are appropriate. You could be affected by this vulnerability either by surfing to an attacker's Web site or by opening an HTML e-mail message from an attacker.

If the security settings are left in their default states, the additional privileges that the Web site would gain would still not allow the page to take any destructive action. The greater danger from this vulnerability occurs if you have given intranet sites additional latitude.

NOTE: The problem that is described in this article does not apply to Internet Explorer 6. However, the patch to which this article links also resolves two other problems that do affect Internet Explorer 6. If you are running Internet Explorer 6, you should apply this patch to resolve the two other issues.

For additional information about the two issues in Internet Explorer 6 that are resolved by the patch, click the article numbers below to view the articles in the Microsoft Knowledge Base:
286043  (http://support.microsoft.com/kb/286043/EN-US/ ) Patch Available for Telnet Logging Vulnerability
308414  (http://support.microsoft.com/kb/308414/EN-US/ ) Patch Available for HTTP Request Encoding Vulnerability

CAUSE

This vulnerability results because it is possible to refer to a Web site by using a particular type of "dotless" IP address. This causes Internet Explorer to handle the site in the Local Intranet zone rather than the correct zone.

RESOLUTION

Internet Explorer 5.5

A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated Microsoft Security Bulletin (http://www.microsoft.com/technet/security/bulletin/ms01-051.mspx) to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now. Otherwise, wait for the next Internet Explorer 5.5 service pack that contains this fix.

To resolve this problem immediately, download the fix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS (http://support.microsoft.com/default.aspx?scid=fh;en-us;cntactms)
NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The "Security Update, December 13, 2001" patch is superseded by the following patch:
316059  (http://support.microsoft.com/kb/316059/EN-US/ ) MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer
The "Security Update, December 13, 2001" patch is available at the following Microsoft Web site:
http://www.microsoft.com/windows/ie/downloads/critical/q313675/default.asp (http://www.microsoft.com/windows/ie/downloads/critical/q313675/default.asp)

Internet Explorer 5.01

The "Security Update, October 10, 2001" patch is superseded by the following patches:
316059  (http://support.microsoft.com/kb/316059/EN-US/ ) MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer
311401  (http://support.microsoft.com/kb/311401/EN-US/ ) Windows 2000 Security Rollup Package 1 (SRP1), January 2002
The "Security Update, October 10, 2001" patch is available at the following Microsoft Web site:
http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=306121&DisplayLang=en (http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=306121&DisplayLang=en)

Internet Explorer 5.01 for Windows 2000

To resolve this problem, obtain the latest service pack for Internet Explorer 5.01 for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
267954  (http://support.microsoft.com/kb/267954/EN-US/ ) How to Obtain the Latest Internet Explorer 5.01 Service Pack

STATUS

Internet Explorer 5.5

Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.5.

Internet Explorer 5.01

Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.01. This problem was first corrected in Internet Explorer 5.01 for Windows 2000 Service Pack 3.

MORE INFORMATION

For more information about this vulnerability, visit the following Microsoft Web site:
http://www.microsoft.com/technet/security/bulletin/ms01-051.mspx (http://www.microsoft.com/technet/security/bulletin/ms01-051.mspx)
You can download the patch for Internet Explorer version 6 from the following Microsoft Web site:
http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=306121&DisplayLang=en (http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=306121&DisplayLang=en)

APPLIES TO
  • Microsoft Internet Explorer 5.5 Service Pack 1
  • Microsoft Internet Explorer 5.5 Service Pack 2
  • Microsoft Internet Explorer 5.01
  • Microsoft Internet Explorer 5.5
  • Microsoft Internet Explorer 6.0, when used with:
    • Microsoft Windows XP Home Edition
    • Microsoft Windows XP Professional
    • Microsoft Windows XP Media Center Edition
    • Microsoft Windows XP Tablet PC Edition
    • Microsoft Windows 2000 Advanced Server
    • Microsoft Windows 2000 Datacenter Server
    • Microsoft Windows 2000 Professional Edition
    • Microsoft Windows 2000 Server
    • Microsoft Windows NT Server 4.0 Standard Edition
    • Microsoft Windows NT Server 4.0, Terminal Server Edition
    • Microsoft Windows NT Workstation 4.0 Developer Edition
    • Microsoft Windows Millennium Edition
    • Microsoft Windows 98 Second Edition
    • Microsoft Windows 98 Standard Edition
Keywords: 
kbnosurvey kbarchive kbbug kbfix kbie501presp3fix kbie550presp3fix kbsecbulletin kbsechack kbsecurity kbsecvulnerability kbwin2000sp3fix KB306121
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support