SYMPTOMS
A vulnerability exists in Internet Explorer that could allow a Web site to take actions that it should not be able to take when you visit the Web site. Specifically, the vulnerability could allow the Web site to trick Internet Explorer into treating the page as though it were located on your intranet, thereby gaining the ability to use less-restrictive security settings than are appropriate. You could be affected by this vulnerability either by surfing to an attacker's Web site or by opening an HTML e-mail message from an attacker.
If the security settings are left in their default states, the additional privileges that the Web site would gain would still not allow the page to take any destructive action. The greater danger from this vulnerability occurs if you have given intranet sites additional latitude.
NOTE: The problem that is described in this article does not apply to Internet Explorer 6. However, the patch to which this article links also resolves two other problems that do affect Internet Explorer 6. If you are running Internet Explorer 6, you should apply this patch to resolve the two other issues.
For additional information about the two issues in Internet Explorer 6 that are resolved by the patch, click the article numbers below
to view the articles in the Microsoft Knowledge Base:
286043 Patch Available for Telnet Logging Vulnerability
308414 Patch Available for HTTP Request Encoding Vulnerability
RESOLUTION
Internet Explorer 5.5
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated
Microsoft Security Bulletin to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now. Otherwise, wait for the next Internet Explorer 5.5 service pack that contains this fix.
To resolve this problem immediately, download the fix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:
NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The "Security Update, December 13, 2001" patch is superseded by the following patch:
316059 MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer
The "Security Update, December 13, 2001" patch is available at the following Microsoft Web site:
Internet Explorer 5.01
The "Security Update, October 10, 2001" patch is superseded by the following patches:
316059 MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer
311401 Windows 2000 Security Rollup Package 1 (SRP1), January 2002
The "Security Update, October 10, 2001" patch is available at the following Microsoft Web site:
Internet Explorer 5.01 for Windows 2000
To resolve this problem, obtain the latest service pack for Internet Explorer 5.01 for Windows 2000. For additional information, click the following article number to view the article in the
Microsoft Knowledge Base:
267954 How to Obtain the Latest Internet Explorer 5.01 Service Pack