• Article

Security Bulletin

Microsoft Security Bulletin MS99-042 - Important

Patch Available for "IFRAME ExecCommand" Vulnerability

Published: October 11, 1999 | Updated: November 04, 1999

Version: 1.0

Originally Posted: October 11, 1999
Updated: October 15, 1999
Re-released: November 04, 1999

Summary

On October 11, 1999, Microsoft released the original version of this bulletin, in order to advise customers of a workaround for a vulnerability in Microsoft® Internet Explorer. The vulnerability could allow a malicious web site operator to read files on the computer of a user who visited the site, under certain circumstances. On October 15, 1999, Microsoft released a patch that eliminated the vulnerability.

However, a regression error was subsequently discovered and corrected. The bulletin has been re-released to provide a corrected version of the patch. The regression affects only IE 5 users; IE 4 users do not need to re-apply the fix for this issue. The FAQ discusses the regression error in more detail.

Frequently asked questions regarding this vulnerability can be found at

https://www.microsoft.com/technet/security/bulletin/fq99-042.mspx.

Issue

The Internet Explorer security model normally restricts the Document.ExecCommand() method to prevent it from taking inappropriate action on a user's computer. However, at least one of these restrictions is not present if the method is invoked on an IFRAME. This could allow a malicious web site operator to read the contents of files on visiting users' computers, if he or she knew the name of the file and the folder in which it resided. The vulnerability would not allow the malicious user to list the contents of folders, create, modify or delete files, or to usurp any administrative control over the machine.

A patch that corrects this vulnerability is available at the location discussed below. This patch also includes the previously-released fix for the "Download Behavior" vulnerability.

Affected Software Versions

  • Microsoft Internet Explorer 4.01, versions prior to Service Pack 2
  • Microsoft Internet Explorer 5

Vulnerability Identifier: CVE-1999-0877

Patch Availability

Internet Explorer 4.01 users should apply IE 4.01 Service Pack 2 at:

Internet Explorer 5 users should apply that patch for this vulnerability at:

https://www.microsoft.com/technet/security/bulletin/ms99-040.mspx.

More Information

Please see the following references for more information related to this issue.

  • Microsoft Security Bulletin MS99-042: Frequently Asked Questions, https://www.microsoft.com/technet/security/bulletin/MS99-042faq.mspx.

  • Microsoft Knowledge Base (KB) article 243638, Update Available for "IFRAME ExecCommand" Vulnerability in Internet Explorer 5, </https:>https:.
    Note   It may take 24 hours from the original posting of this bulletin for this KB article to be visible.

  • Microsoft Security web site, </https:>https:.

Obtaining Support on this Issue

This is a fully supported patch. Information on contacting Microsoft Technical Support is available at </https:>https:.

Acknowledgments

Microsoft acknowledges Georgi Guninski for bringing this issue to our attention.

Revisions

  • October 11, 1999: Bulletin Created.
  • October 15, 1999: Bulletin updated to provide information on availability of patch.
  • November 04, 1999: Bulletin re-released to provide information about regression error and updated patch.

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Built at 2014-04-18T13:49:36Z-07:00 </https:>