IE security hole -- even while using another browser!

Patch released June 2003

[tedster]

This one threw me for a loop, and I haven't seen mention of it before. The patch is about a month old, but important enough for everyone with Internet Explorer installed -- pretty much any Windows user, right? -- even if you just use IE for testing:

June 2003
Cumulative Patch for Internet Explorer (818529)

...an attacker could run programs on a computer used to view the attacker's Web site. This vulnerability affects computers that have Microsoft® Internet Explorer installed. You do not have to be using Internet Explorer as your Web browser to be affected by this issue.

Microsoft Link [microsoft.com]

[Hester]

Another good reason not to tie the browser in with the OS.

Have you seen the latest CSS3 specs [w3c.org] though? Maybe Microsoft are working on these, as they have commands to interact with the OS [w3c.org] and cause system operations to occur. How the independent browsers will deal with these I'm unsure.

[tedster]

Thanks, Hester. That's my first look at the new stuff.

Maybe Microsoft are working on these

A quick look shows these Microsoft people involved over the past two years with the CSS3 draft: Michel Suignard, Tantek Çelik, Michel Suignard -- probably others as well.

Poor Tantek. That last initial of his gives a lot of rendering problems! In case your machine isn't showing it properly, it's a cedilla -- a sort of "C" with a tail. For some reason it looks fine here, but doesn't render at all for me on the W3C site.

Another good reason not to tie the browser in with the OS

Here, here. I couldn't agree more. I'll sacrifice some bells and whistles for security, if given a chance. Unfortunately, nobody's asking me.

Fortunately (I guess) this last patch was pushed on me when I opened up Explorer and was taken to the Windows Update page automatically. I'm glad I allowed the check-up to occur.

[Hester]

There's something odd about this case. It doesn't affect the browser, yet it's a patch for Internet Explorer?! I assume it is really a patch for Windows then. Windows uses the Explorer code to display files, emails etc. So if the core code itself has a security hole, that means so does Windows!

Yet I can see people using other browsers not bothering to upgrade if it's been classed as a bug in Explorer only.

Poor Tantek. That last initial of his gives a lot of rendering problems! In case your machine isn't showing it properly, it's a cedilla -- a sort of "C" with a tail. For some reason it looks fine here, but doesn't render at all for me on the W3C site.

Works fine in Mozilla 1.4 on XP.