Update Available for MSHTML Security Issues in Internet Explorer

ID: Q226325

The information in this article applies to:

Microsoft Internet Explorer versions 4.0, 4.01 Service Pack 2, 5 for Windows 98
Microsoft Internet Explorer versions 4.0, 4.01, 4.01 Service Pack 1, 4.01 Service Pack 2, 5 for Windows 95
Microsoft Internet Explorer versions 4.0, 4.01, 4.01 Service Pack 1, 4.01 Service Pack 2, 5 for Windows NT 4.0
Microsoft Windows 98

SUMMARY

An updated version of the "IFRAME ExecCommand" Vulnerability update was posted on November 4, 1999. This update also fixes the MSHTML issues in Microsoft Internet Explorer 5 previously documented in this article as well as the MSHTML issue documented in the following article in the Microsoft Knowledge Base:

NOTE: This problem is resolved in Microsoft Internet Explorer 5.01.

Q242542 Download Behavior Vulnerability in Internet Explorer 5

For additional information about this issue, please see the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/ms99-040.asp

For additional information about the IFRAME ExecCommand" vulnerability, please see the following article in the Microsoft Knowledge Base:

Q243638 Update Available for IFRAME ExecCommand Vulnerability in Internet Explorer 5

Additional information about this issue is available from the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/MS99-042.asp

On April 21, 1999, Microsoft released an update to Internet Explorer 4.x and 5 that addresses multiple security vulnerabilities in Internet Explorer's parsing engine, Mshtml.dll. Additional information about these issues is available from the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/MS99-012.asp

Updates are available for the following products:

Microsoft Internet Explorer 4.0, 4.01 for Windows 95 and Windows NT 4.0 (x86 and Alpha)

Microsoft Windows 98 Internet Explorer 4.01 SP1/SP2)

This update addresses the following three vulnerabilities in Internet Explorer 4.x:

The IMG SRC tag can point to items other than images, allowing someone to obtain access to information about local files through Internet Explorer's object model.

A new variant of the "cross-frame" vulnerability that was previously addressed. For additional information about this issue, please see the following article(s) in the Microsoft Knowledge Base:
Q168485 Update Available for Cross-Frame Security Issue

A new variant of the previously-addressed "untrusted scripted paste" vulnerability. For additional information about this issue, please see the following article(s) in the Microsoft Knowledge Base:
Q169245 Update Available for "Untrusted Scripted Paste" Issue

Additionally, This update also fixes the "Untrusted Scripted Paste", "Cross Frame Navigate", and "Frame Spoof" security issues in Microsoft Internet Explorer running on Windows operating systems. For additional information about these issues, please see the following article(s) in the Microsoft Knowledge Base:

Q169245 Update Available for "Untrusted Scripted Paste" Issue

Q168485 Update Available for Cross-Frame Security Issue

Q167614 Update Available For "Frame Spoof" Security Issue

MORE INFORMATION

Update Information by Product:

NOTE: If you are using Internet Explorer 4.0 or 4.01, you must install Internet Explorer 4.01 Service Pack 1 or 2 in order to apply this update. You can install Internet Explorer 4.01 with Service Pack 2 from the following Microsoft Web site:

http://www.microsoft.com/windows/ie/download

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows 95

Update File Name: mshtml4.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,422,544	4-13-99	4.72.3616.1301
Mshtmlwb.dll	55,872	4-14-99	4.72.3616.1400

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows NT 4.0 (x86)

Update File Name: mshtml4.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp/

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,422,544	4-13-99	4.72.3616.1301
Mshtmlwb.dll	55,872	4-14-99	4.72.3616.1400

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows NT 4.0 (Alpha)

Update File Name: mshtml4ax.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	3,951,888	4-14-99	4.72.3616.1400
Mshtmlwb.dll	113,424	4-15-99	4.72.3616.1400

Windows 98 (Internet Explorer 4.01 SP1/SP2)

Update File Name: mshtml4.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,422,544	4-13-99	4.72.3616.1301
Mshtmlwb.dll	55,872	4-14-99	4.72.3616.1400

Microsoft Internet Explorer 5 for Windows 95, Windows 98, or Windows NT 4.0 (x86)

Update File Name: Mshtml5.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	2,359,568	4-14-99	5.00.2614.3401

Microsoft Internet Explorer 5 for Windows NT 4.0 (Alpha)

Update File Name: Mshtml5ax.exe
Availability: http://www.microsoft.com/windows/ie/security/mshtml.asp

Updated File Name	Size (bytes)	Date	Version
Mshtml.dll	4,982,544	4-14-99	5.00.2614.3401

Additional query words: 2.0 2.00 4.00 5.0 5.00

Keywords : kbfile msiew95 msient win98 msiew98
Version : WINDOWS:4.0,4.01,4.01 Service Pack 1,4.01 Service Pack 2,5
Platform : WINDOWS
Issue type : kbinfo