Microsoft battles old, new security holes with IE patch

ITworld.com 2/12/02

Matt Berger, IDG News Service, San Francisco Bureau
Microsoft Corp. issued a security patch Monday that fixes six holes in
its Internet Explorer Web browser, just as a nasty Internet worm that
threatens to overwrite certain PC files continued its assault on users.

The "cumulative" patch made available for download Monday fixes holes in
versions 5.01, 5.5 and 6.0 of Internet Explorer. It addresses six
vulnerabilities discovered in the past few months, one of which could
allow a malicious hacker to run code on another user's computer,
Microsoft said. Microsoft gave the vulnerabilities a "critical" rating,
and advised users to download the patch from its Web site immediately.

One of the holes could disguise the name of a file posted on a Web site
so that a user might be tricked into opening or saving the file without
knowing it is unsafe. Other vulnerabilities could allow an attacker to
run code or view certain files on a user's PC, or run a script even when
the user has disabled scripting, Microsoft said.

The patch and a technical description of the flaws are on Microsoft's
Web site at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur
ity/bulletin/MS02-005.asp/ .

In addition, the cumulative patch includes a handful of previously
released fixes for other holes found in the browser. One of those fixes
is designed to block a worm known as "Klez," which has threatened some
Internet Explorer users since it first circulated via e-mail in October.

Several variants of the Klez worm have emerged, including a recent one
known as "Klez.e," which poses the most serious threat, according to
Kaspersky Labs Ltd., a security research company based in Moscow. Last
week, Kaspersky Labs released a software tool designed to detect and
delete the Klez.e worm from infected computers.

Klez.e affects Internet Explorer versions 5.01 and 5.5, and strikes at a
vulnerability in the Web browser first identified in March of last year.
"This is a relatively old vulnerability," said Vincent Weafer, senior
director of the security response team at security software company
Symantec Corp. Microsoft has issued patches for that hole in the past.

Klez.e can automatically launch itself when a user views an e-mail
infected with the worm. Those e-mails use one of 20 words or phrases in
the subject line, and contain either no text or random text in the body
of the message, Kaspersky said. The words and phrases are listed on
Kapsersky's Web site.

If a user opens an infected e-mail in Outlook or Outlook Express the
worm tries to redirect itself as an email attachment to everyone listed
in the user's address book. It also attempts to overwrite certain PC
files including text, HTML and MPEG files.

More threatening, Klez.e is triggered to overwrite all the files on a
user's computer on the sixth day of every odd-numbered month, with the
next "hot date" being March 6.

The worm also tries to disable antivirus software on a user's PC, though
Symantec said its Norton Antivirus tools are protected. For antivirus
programs that remain susceptible, the worm could render the user
interface unviewable or interfere with the "real-time scanner" which
searches for viruses.

The same vulnerability in Internet Explorer that allows for Klez.e to do
its harm was partly responsible for the Nimda virus that emerged last
year, Weafer said. "We've had other worms in the past that exploited the
same vulnerability," he said.

Symantec has received about 1,000 notifications of Klez.e from home and
corporate users since Jan. 18, when the harmful variant surfaced. Those
submissions have now "leveled off," Weafer said, but Symantec still
regards the worm as a "moderate" threat. By comparison, the company has
received about 5,000 submissions of the Magistr worm and about 8,000
submissions of the Badtrans worm, he said.

Klez.e was among the top 10 most frequently occurring viruses this
month, according to antivirus protection company Sophos Inc., in
Wakefield, Massachusetts.

Kapersky Lab's tool for detecting the Klez.e worm, and a list of the 20
words and phrases that appear in the subject line of infected emails,
are on its Web site at
http://www.kaspersky.com/news.html?tnews=20140&id=224578/.

Matt Berger is a correspondent for the IDG News Service.


VICUG-L is the Visually Impaired Computer User Group List.
To join or leave the list, send a message to
[log in to unmask]  In the body of the message, simply type
"subscribe vicug-l" or "unsubscribe vicug-l" without the quotations.
 VICUG-L is archived on the World Wide Web at
http://maelstrom.stjohns.edu/archives/vicug-l.html