Update Available for MSHTML Security Issues in Internet Explorer (226325)

SUMMARY

An updated version of the "IFRAME ExecCommand" Vulnerability update was posted on November 4, 1999. This update also fixes the MSHTML issues in Microsoft Internet Explorer 5 previously documented in this article as well as the MSHTML issue documented in the following article in the Microsoft Knowledge Base:

NOTE: This problem is resolved in Microsoft Internet Explorer 5.01.

242542 Download Behavior Vulnerability in Internet Explorer 5

For additional information about this issue, please see the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/ms99-040.asp

For additional information about the IFRAME ExecCommand" vulnerability, please see the following article in the Microsoft Knowledge Base:

243638 Update Available for IFRAME ExecCommand Vulnerability in Internet Explorer 5

Additional information about this issue is available from the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/MS99-042.asp

On April 21, 1999, Microsoft released an update to Internet Explorer 4.x and 5 that addresses multiple security vulnerabilities in Internet Explorer's parsing engine, Mshtml.dll. Additional information about these issues is available from the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/MS99-012.asp

Updates are available for the following products:

Microsoft Internet Explorer 4.0, 4.01 for Windows 95 and Windows NT 4.0 (x86 and Alpha)
Microsoft Windows 98 Internet Explorer 4.01 SP1/SP2)

This update addresses the following three vulnerabilities in Internet Explorer 4.x:

The IMG SRC tag can point to items other than images, allowing someone to obtain access to information about local files through Internet Explorer's object model.
A new variant of the "cross-frame" vulnerability that was previously addressed. For additional information about this issue, please see the following article(s) in the Microsoft Knowledge Base:
168485 Update Available for Cross-Frame Security Issue
A new variant of the previously-addressed "untrusted scripted paste" vulnerability. For additional information about this issue, please see the following article(s) in the Microsoft Knowledge Base:
169245 Update Available for "Untrusted Scripted Paste" Issue

Additionally, This update also fixes the "Untrusted Scripted Paste", "Cross Frame Navigate", and "Frame Spoof" security issues in Microsoft Internet Explorer running on Windows operating systems. For additional information about these issues, please see the following article(s) in the Microsoft Knowledge Base:

169245 Update Available for "Untrusted Scripted Paste" Issue

168485 Update Available for Cross-Frame Security Issue

167614 Update Available For "Frame Spoof" Security Issue

MORE INFORMATION

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows 95

Update File Name: mshtml4.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,422,544	4-13-99	4.72.3616.1301
Mshtmlwb.dll	55,872	4-14-99	4.72.3616.1400

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows NT 4.0 (x86)

Update File Name: mshtml4.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp/

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,422,544	4-13-99	4.72.3616.1301
Mshtmlwb.dll	55,872	4-14-99	4.72.3616.1400

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows NT 4.0 (Alpha)

Update File Name: mshtml4ax.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	3,951,888	4-14-99	4.72.3616.1400
Mshtmlwb.dll	113,424	4-15-99	4.72.3616.1400

Windows 98 (Internet Explorer 4.01 SP1/SP2)

Update File Name: mshtml4.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,422,544	4-13-99	4.72.3616.1301
Mshtmlwb.dll	55,872	4-14-99	4.72.3616.1400

Microsoft Internet Explorer 5 for Windows 95, Windows 98, or Windows NT 4.0 (x86)

Update File Name: Mshtml5.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,359,568	4-14-99	5.00.2614.3401

Microsoft Internet Explorer 5 for Windows NT 4.0 (Alpha)

Update File Name: Mshtml5ax.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	4,982,544	4-14-99	5.00.2614.3401