Select the product you need help with

MS01-055: Internet Explorer Cookie Data Can Be Exposed or Altered Through Script Injection

Article ID: 312461 - View products that this article applies to.

This article was previously published under Q312461

SYMPTOMS

A potential security vulnerability exists in Internet Explorer versions 5.5 and 6 that may allow a malicious user to create an URL that allows a Web site to gain unauthorized access to cookies that are stored on your computer and then (potentially) modify the values that are contained in them. Because some Web sites use cookies that are stored on your computer to store sensitive information, it is also possible that personal information could be exposed.

Maliciously exploiting this vulnerability would require that a user choose to click an URL link on a page that an attacker has hosted on his or her site, or to click an URL link that is embedded in an HTML e-mail message that the attacker has sent. It cannot be automatically invoked without user interaction.

Mitigating Factors

A user must first be convinced to visit a malicious Web site or to open an HTML e-mail message that contains the malformed URL. The user would then have to choose to click a specially formed URL link.
Users who have applied the Microsoft Outlook E-mail Security Update are not affected by the HTML e-mail exploitation of this vulnerability.
Users who have set Outlook Express to use the Restricted Sites zone are not affected by the HTML e-mail exploitation of this vulnerability. Note that this is the default setting for Microsoft Outlook Express 6.

Back to the top | Give Feedback

RESOLUTION

IMPORTANT: This patch requires that domains that use cookies MUST only have alpha-numeric characters (or '-' or '.') in the domain name. If they do not, cookies may not work properly.

Internet Explorer 6

To resolve this problem, obtain the latest service pack for Internet Explorer 6. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

328548

(http://support.microsoft.com/kb/328548/EN-US/ )

How to Obtain the Latest Internet Explorer 6 Service Pack

The "Security Update, December 13, 2001" patch is superseded by the following patch:

316059

(http://support.microsoft.com/kb/316059/EN-US/ )

MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer

The "Security Update, December 13, 2001" patch is available at the following Microsoft Web site:

http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=313675&DisplayLang=en

(http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=313675&DisplayLang=en)

Internet Explorer 5.5

A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated Microsoft Security Bulletin

(http://www.microsoft.com/technet/security/bulletin/ms01-051.mspx)

to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now. Otherwise, wait for the next Internet Explorer 5.5 service pack that contains this fix.

To resolve this problem immediately, download the fix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

(http://support.microsoft.com/default.aspx?scid=fh;en-us;cntactms)

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The "Security Update, December 13, 2001" patch is superseded by the following patch:

316059

(http://support.microsoft.com/kb/316059/EN-US/ )

MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer

The "Security Update, December 13, 2001" patch is available at the following Microsoft Web site:

http://www.microsoft.com/windows/ie/downloads/critical/q313675/default.asp

(http://www.microsoft.com/windows/ie/downloads/critical/q313675/default.asp)

NOTE: To prevent the computer from rebooting during installation, add the "/r:n." (without quotes) switch to the Q312461.exe file when you install the patch.

Back to the top | Give Feedback

WORKAROUND

To work around this issue, you can disable active scripting in the Internet and Intranet zones in Internet Explorer. To prevent this vulnerability from being used when you are using the HTML rendering feature of Outlook Express, you should configure Outlook Express to use the Restricted Sites zone.

Disable Active Scripting in Internet Explorer

Start Internet Explorer.
On the Tools menu, click Internet Options.
On the Security tab, click Custom Level.
In the Settings box, click Disable under Active scripting and Scripting of Java applets.
Click OK, and then click OK.

NOTE: If you disable active scripting in Internet Explorer and you use Microsoft Outlook Web Access (OWA) as an e-mail client, you may lose some OWA functionality. To retain full functionality in OWA, do not disable active scripting in Internet Explorer.

Enable Restricted Sites in Outlook Express

Start Outlook Express.
On the Tools menu, click Options.
Click the Security tab, click Restricted sites zone (More Secure), and then click OK.

NOTE: For sites that have been disabled, or had their functionality changed by turning off active scripting, adding that site into the Trusted sites zone can enable these sites. All sites entered this way have the security settings associated with being in a trusted zone. To do this:

Start Internet Explorer.
On the Tools menu, click Internet Options, and then click the Security tab.
Click to select Trusted sites, and then click Sites.
Type the name of the web page to be listed as a trusted site, and then click Add. Repeat this process for each web page to be added to the list.
When you have entered all the web pages to the list, click OK, and then click OK.

Back to the top | Give Feedback

STATUS

Internet Explorer 6

Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 6. This problem was first corrected in Internet Explorer 6 Service Pack 1.

Internet Explorer 5.5

Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.5.

Back to the top | Give Feedback

MORE INFORMATION

For more information on this vulnerability, see the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/ms01-055.mspx

(http://www.microsoft.com/technet/security/bulletin/ms01-055.mspx)

Back to the top | Give Feedback

Properties

Article ID: 312461 - Last Review: January 31, 2007 - Revision: 4.13

APPLIES TO

Microsoft Outlook Express 5.5
Microsoft Outlook Express 5.5
Microsoft Outlook Express 5.5
Microsoft Outlook Express 5.5
Microsoft Outlook Express 5.5
Microsoft Internet Explorer 5.5 Service Pack 2
Microsoft Internet Explorer 5.5 Service Pack 2
Microsoft Internet Explorer 5.5 Service Pack 2
Microsoft Internet Explorer 5.5 Service Pack 2
Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 5.5 Service Pack 2
Microsoft Internet Explorer 6.0, when used with:

Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
Microsoft Windows XP Media Center Edition
Microsoft Windows XP Tablet PC Edition
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional Edition
Microsoft Windows 2000 Server
Microsoft Windows NT Server 4.0 Standard Edition
Microsoft Windows NT Server 4.0, Terminal Server Edition
Microsoft Windows NT Workstation 4.0 Developer Edition
Microsoft Windows Millennium Edition
Microsoft Windows 98 Second Edition
Microsoft Windows 98 Standard Edition

Microsoft Outlook Express 6.0
Microsoft Outlook Express 6.0
Microsoft Outlook Express 6.0
Microsoft Outlook Express 6.0
Microsoft Outlook Express 6.0
Microsoft Outlook Express 6.0

kbbug kbenv kbfix kbie550presp3fix kbie600presp1fix kbinterop kbnetwork kbsechack kbsecurity kbsecvulnerability kbwin2000sp3fix kbie600sp1fix KB312461

Back to the top | Give Feedback