¢Ñ鹵͹·ÕèÊÒÁÒö´Óà¹Ô¹¡ÒÃà¾×èÍÃкØáÅЪèÇ»éͧ¡Ñ¹µÑǨҡàÇçºä«µìËÅÍ¡ÅǧáÅÐäÎà»ÍÃìÅÔ§¤ì·ÕèäÁè»ÃÐʧ¤ì´Õ

àÁ×èͤسªÕéä»·Õèàª×èÍÁâ§ËÅÒÂÁÔµÔã¹ Microsoft Internet Explorer, Microsoft Outlook Express ËÃ×Í Microsoft Outlook ·ÕèÍÂÙè¢Í§àÇçºä«µì»ÃÒ¡¯¢Öé¹ã¹á¶ºÊ¶Ò¹Ð·Õè´éÒ¹ÅèÒ§¢Í§Ë¹éÒµèÒ§â´Â·ÑèÇä» ËÅѧ¨Ò¡·Õè¤Ø³¤ÅÔ¡¡ÒÃàª×èÍÁ⧷Õèà»Ô´ã¹ Internet Explorer ÍÂÙè¢Í§àÇçºä«µìâ´Â»¡µÔ»ÃÒ¡¯ã¹á¶º·ÕèÍÂÙè¢Í§ Internet Explorer áÅЪ×èÍàÃ×èͧ¢Í§àÇçºà¾¨¹Ñé¹â´Â»¡µÔ»ÃÒ¡¯ã¹á¶ºª×èÍàÃ×èͧ¢Í§Ë¹éÒµèÒ§

ÍÂèÒ§äáçµÒÁ ¼Ùéãªé·Õèà»ç¹ÍѹµÃÒÂÊÒÁÒöÊÃéÒ§¡ÒÃàª×èÍÁâ§ÅǧãËéà¢éÒ㨼Դ (»ÅÍÁ) àÇçºä«µì·ÕèáÊ´§ÍÂÙè ËÃ×Í URL ä»ÂѧàÇçºä«µì·Õè¶Ù¡µéͧã¹Ê¶Ò¹Ðᶺ ᶺ·ÕèÍÂÙè áÅÐᶺª×èÍàÃ×èͧ º·¤ÇÒÁ¹Õé͸ԺÒ¢Ñ鹵͹·Õè¤Ø³ÊÒÁÒöãªé à¾×èͪèÇÂÅ´»Ñ­ËÒ¹Õé áÅЪèÇÂãËé¤Ø³ÊÒÁÒöÃкØàÇçºä«µì (»ÅÍÁ) ËÅÍ¡ÅǧËÃ×Í URL

º·¤ÇÒÁ¹Õé͸ԺÒ¢Ñ鹵͹¤Ø³ÊÒÁÒöãªéà¾×èͪèÇ»¡»éͧ´éǵÑÇàͧ¨Ò¡àÇçºä«µì»ÅÍÁ àÁ×è͵éͧ¡ÒÃÊÃØ» ¢Ñ鹵͹àËÅèÒ¹Õé¤×Í:

• µÔ´µÑ駡Òà MS04-004 »ÃѺ»Ãا¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂÊÐÊÁÊÓËÃѺ Internet Explorer (832894)
• µÃǨÊͺÇèÒ ÁÕäͤ͹'ÅçÍ¡'ã¹Ê¶Ò¹Ð·Õè´éÒ¹¢ÇÒÅèҧᶺ áÅеÃǨÊͺª×èͧ͢à«ÔÃì¿àÇÍÃì·ÕèãËé˹éÒÇèÒ ¤Ø³¡ÓÅѧ´Ù¡è͹·Õè¤Ø³¾ÔÁ¾ì¢éÍÁÙÅÊèǹºØ¤¤Å ËÃ×ÍÊӤѭ㴠æ
• ÍÂèÒ¤ÅÔ¡·Õèã´ æ àª×èÍÁâ§ËÅÒÂÁÔµÔ·Õè¤Ø³äÁèàª×èͶ×Í ¾ÔÁ¾ìàËÅèÒ¹Ñé¹ã¹·ÕèÍÂÙèᶺµÑǤسàͧ

¡ÒõԴµÑ駡Òà MS04-004 »ÃѺ»Ãا¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂÊÐÊÁÊÓËÃѺ Internet Explorer (832894)

ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺ¡ÒûÃѺ»Ãا¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀѹÕé áÇÐä»·ÕèàÇçºä«µìµèÍ仹Õé¢Í§ Microsoft:º·¤ÇÒÁ¹ÕéÂѧ¡ÅèÒǶ֧¢Ñ鹵͹·Õè¨ÐªèÇÂãËé¤Ø³ÃкØàÇçºä«µì»ÅÍÁáÅСÒÃàª×èÍÁâ§ËÅÒÂÁÔµÔ·Õèà»ç¹ÍѹµÃÒÂ

ËÁÒÂà˵Ø:¤Ø³äÁèÁÕ¡ÒõԴµÑé§â»Ãá¡ÃÁ»ÃѺ»Ãا¹Õé¶éҤسä´éµÔ´µÑé§ Microsoft Windows XP Service Pack 2 ä´éáÅéÇ ¡ÒûÃѺ»Ãا¨ÐÃÇÁÍÂÙèã¹ service pack ¹Õé

ÊÔ觷Õè¤Ø³ÊÒÁÒö·Óà¾×èͪèÇ»¡»éͧ´éǵÑÇàͧ¨Ò¡àÇçºä«µì»ÅÍÁ

µÃǨÊͺãËéá¹èã¨ÇèÒ àÇçºä«µìãªé Secure Sockets Layer/¡Òà ¢¹Êè§ Layer Security (SSL/TLS) áÅеÃǨÊͺª×èͧ͢à«ÔÃì¿àÇÍÃì¡è͹·Õè¤Ø³¾ÔÁ¾ì¢éÍÁÙÅ·ÕèÊӤѭ㴠æ

â´Â»¡µÔ¨Ðãªé ssl/TLS à¾×èͪèÇ»¡»éͧ¢éÍÁÙŢͧ¤Ø³ µÒÁ·ÕèÁѹ travels ¼èÒ¹ÍÔ¹à·ÍÃìà¹çµ â´Â¡ÒÃà¢éÒÃËÑÊÅѺäÇé ·ÓÍÂèÒ§äáçµÒÁ ÁѹÂѧ˹éÒ·Õè¡ÒþÔÊÙ¨¹ìÇèÒ ¤Ø³¡ÓÅѧÊ觢éÍÁÙÅä»Âѧà«ÔÃì¿àÇÍÃì·Õè¶Ù¡µéͧ â´Â¡ÒõÃǨÊͺª×èÍã¹¼ÙéãªéãºÃѺÃͧ´Ô¨Ô·ÑÅÊÓËÃѺ SSL/TLS ¤Ø³ÊÒÁÒöµÃǨÊͺ¢éͤÇÒÁáÊ´§ª×èͧ͢à«ÔÃì¿àÇÍÃì·ÕèÁÕྨ·Õè¤Ø³¡ÓÅѧ´ÙÍÂÙè àÁ×è͵éͧ¡Ò÷Óàªè¹¹Õé µÃǨÊͺÇèÒ äͤ͹'ÅçÍ¡'»ÃÒ¡¯¢Öé¹·ÕèÁØÁ¢ÇÒÅèÒ§¢Í§Ë¹éÒµèÒ§ Internet Explorer

ËÁÒÂà˵Ø:If the status bar is not enabled, the lock will not appear. To enable the Status bar, clickÁØÁÁͧ¨Ò¡¹Ñé¹ ¤ÅÔ¡à¾×èÍàÅ×Í¡Status Bar.

To verify the name of the server that appears on the digital certificate, double-click the lock icon, and then check the name that appears next toIssued to. If the Web site does not use SSL/TLS, do not send any personal or sensitive information to the site. If the name that appears next toIssued tois different from the name of the site that you thought provides the page that you are viewing, close the browser to leave the site. For additional information about how to do this, visit the following Microsoft Web site:

Things that you can do to help protect yourself from malicious hyperlinks

The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. Rather, type the URL of your intended destination in the address bar yourself. By manually typing the URL in the address bar, you can verify the information that Internet Explorer uses to access the destination Web site. To do so, type the URL in the Address bar, and then press ENTER.

ËÁÒÂà˵Ø:The Address bar does not appear if it is not enabled. To enable the Address bar, clickÁØÁÁͧªÕéä»·Õèᶺà¤Ã×èͧÁ×ͨҡ¹Ñé¹ ¤ÅÔ¡à¾×èÍàÅ×Í¡Address Bar.

Some things that you can do to identify spoofed sites when the Web site is not using SSL/TLS

The most effective step that you can take to verify the name of the site that provides the page that you are viewing is to verify the name on a digital certificate using SSL/TLS. But if the site does not use SSL/TLS, you cannot conclusively verify the name of the site that provides the page that you are viewing. However, there are some things that you can do that, in some cases, may help you identify spoofed sites.

¢éͤÇÃÃÐÇѧThe following information provides general guidelines based on well-known attacks. Because attacks change constantly, malicious users could create spoofed Web sites by using means other than those that are described here. To help protect yourself, type personal or sensitive information on a Web site only if you have verified the name on the digital certificate. Also, if you have any reason to suspect the authenticity of a site, leave it by closing the browser window immediately. Frequently, the quickest way to close the browser window is to press ALT+F4.

Try to identify the URL of the current Web page

To try to identify the URL of the current Web site, use the following methods.

Use Jscript commands to try to identify the actual URL for the current Web site

Use a JScript command in Internet Explorer. In the Address bar, type the following command, and then press ENTER:¢éͤÇÃÃÐÇѧUse caution when you type script directly in the Address bar. Script that you type directly in the Address bar can take the same actions on the local system as the user who is currently logged on.

The JScript message box shows the actual URL Web address for the Web site that you are visiting.

You can also copy the following JScript code and paste it in the Address bar for a more verbose description of the Web site URL:Compare the actual URL with the URL in the Address bar. If they do not match, the Web site is likely misrepresenting itself. In this case, you may want to close Internet Explorer.

Use the Internet Explorer History pane to try to identify the actual URL for the current Web site

In the scenarios that Microsoft has tested, you can also use the History Explorer Bar in Internet Explorer to help identify the URL of a Web page. 㹡ÒÃÁØÁÁͧàÁ¹Ù ãËéªÕéä»·ÕèExplorer BaráÅéÇ ¤ÅÔ¡»ÃÐÇѵÔ. Compare the URL in the Address bar with the URL that appears in the History bar. If they do not match, the Web site is likely misrepresenting itself and you may want to close Internet Explorer.

Paste the URL in the Address bar of a new instance of Internet Explorer

You can paste the URL in the Address bar of a new instance of Internet Explorer. By doing so, you may be able to verify the information that Internet Explorer will use to access the destination Web site. In the scenarios that Microsoft has tested, you can copy the URL that appears in the Address bar and paste it in the address bar of a new session of Internet Explorer to verify the information Internet Explorer will actually use to access the destination Web site. This process is similar to the step that is discussed in “Things that you can do to help protect yourself from spoofed Web sites” section earlier in this article.

¢éͤÇÃÃÐÇѧIf you perform this action on some sites, such as on e-commerce sites, the action can potentially cause your current session to be lost. For example, the contents of an online shopping cart may be lost, and you may have to repopulate the cart.

To paste the URL in the Address bar of a new instance of Internet Explorer, follow these steps:

1. Select the text in the Address bar, right-click the text, and then clickCopy.
2. »Ô´ Internet Explorer
3. àÃÔèÁ Internet Explorer
4. Click in the Address bar, right-click, and then clickÇÒ§.
5. ¡´ ENTER

Some things that you can do to identify malicious hyperlinks

The only way that you can verify the information that Internet Explorer will use to access the destination Web site is by manually typing the URL in the address bar. However, there are some things that you can do that, in some cases, may help you identify a malicious hyperlink.

¢éͤÇÃÃÐÇѧ¢éÍÁÙŵèÍ仹ÕéãËé¤Óá¹Ð¹Ó·ÑèÇä»·Õè¢Öé¹ÍÂÙè¡Ñº¡ÒÃâ¨ÁµÕ·ÕèÃÙé¨Ñ¡¡Ñ¹´Õ à¹×èͧ¨Ò¡¡ÒÃâ¨ÁµÕà»ÅÕè¹ constantly ¼Ùéãªé·Õèà»ç¹ÍѹµÃÒÂÊÒÁÒöÊÃéÒ§àÇçºä«µì»ÅÍÁ â´ÂãªéËÁÒ¤ÇÒÁÇèÒÍ×蹹͡à˹×ͨҡ·Õè͸ԺÒÂäÇé·Õè¹Õè àÁ×è͵éͧªèÇ»¡»éͧµÑǤسàͧ ¾ÔÁ¾ì¢éÍÁÙÅÊèǹºØ¤¤Å ËÃ×ÍÊӤѭº¹àÇçºä«µì੾ÒÐ㹡óշÕè¤Ø³ä´éÃѺ¡ÒõÃǨÊͺª×èÍ㹡ÒÃÃѺÃͧ´Ô¨Ô·ÑÅ ä´é ¶éҤسÁÕà˵ؼÅã´ æ à¾×èͤÇÒÁ¶Ù¡µéͧ¢Í§ä«µì·ÕèʧÊÑ »ÅèÍÂäÇé â´Â¡ÒûԴ˹éÒµèÒ§àºÃÒÇìà«ÍÃì·Ñ¹·Õ ºèͤÃÑé§ ÇÔ¸Õ quickest à¾×èͻԴ˹éÒµèÒ§àºÃÒÇìà«ÍÃìÍÂÙèãËé ¡´ ALT + F4

¤ÇÒÁ¾ÂÒÂÒÁ·ÕèÃÐºØ URL ·Õèàª×èÍÁâ§ËÅÒÂÁÔµÔ¨Ðãªé

㹡ÒÃÃÐºØ URL ·Õèàª×èÍÁâ§ËÅÒÂÁÔµÔ¨Ðãªé ´Óà¹Ô¹¡ÒôѧµèÍ仹Õé:

1. ¤ÅÔ¡¢ÇÒ¡ÒÃàª×èÍÁ⧠áÅШҡ¹Ñé¹ ¤ÅÔ¡¤Ñ´ÅÍ¡·Ò§ÅÑ´.
2. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹáÅéÇ ¤ÅÔ¡àÃÕ¡ãªé.
3. »ÃÐàÀ·:notepadáÅéÇ ¤ÅÔ¡µ¡Å§.
4. 㹡ÒÃá¡é䢤ÅÔ¡·ÕèàÁ¹Ùã¹ NotepadÇÒ§.

¡Ò÷Óàªè¹¹Õé ¤Ø³ÊÒÁÒö´Ù URL ẺàµçÁÊÓËÃѺ¡ÒÃàª×èÍÁâ§ËÅÒÂÁÔµÔã´ æ áÅФسÊÒÁÒöµÃǨÊͺÍÂÙè·Õè Internet Explorer ¨Ðãªé ÃÒ¡ÒõèÍ仹ÕéáÊ´§ºÒ§Êèǹ¢Í§ÍÑ¡¢ÃзÕèÍÒ¨»ÃÒ¡¯¢Öé¹ã¹ URL ·ÕèÊÒÁÒö¹Óä»ÂѧàÇçºä«µì»ÅÍÁ:

• % 00
• % 01
• @

µÑÇÍÂèÒ§àªè¹ URL ¢Í§áºº¿ÍÃìÁµèÍ仹Õé¨Ðà»Ô´ http://example.com áµè URL ã¹á¶ºÍÂÙèËÃ×ÍᶺʶҹÐã¹ Internet Explorer ÍÒ¨»ÃÒ¡¯¢Öé¹à»ç¹ http://www.wingtiptoys.com:

¢Ñ鹵͹Í×è¹ æ ·ÕèÊÒÁÒö´Óà¹Ô¹¡ÒÃ

áÁéÇèÒ¡ÒôÓà¹Ô¹¡ÒÃàËÅèÒ¹ÕéäÁèÊÒÁÒöªèǤسÃкØàÇçºä«µì (»ÅÍÁ) ËÅÍ¡ÅǧËÃ×Í URL ¾Ç¡à¢ÒÊÒÁÒöªèǨӡѴ¤ÇÒÁàÊÕÂËÒ¨ҡ¡ÒÃâ¨ÁµÕ·ÕèÊÓàÃ稨ҡàÇçºä«µì»ÅÍÁËÃ×Í¡ÒÃàª×èÍÁâ§ËÅÒÂÁÔµÔ·Õèà»ç¹ÍѹµÃÒ ÍÂèÒ§äáçµÒÁ ¨Ð¨Ó¡Ñ´¢éͤÇÒÁÍÕàÁÅáÅÐàÇçºä«µìã¹â«¹ÍÔ¹à·ÍÃìà¹çµãËéàÃÕ¡ãªéʤÃÔ»µì µÑÇ ¤Çº¤ØÁ ActiveX áÅÐà¹×éÍËÒÍ×è¹ æ ·ÕèÍÒ¨ damaging

• ãªéࢵ¾×é¹·Õèà¹×éÍËÒã¹àÇ红ͧ¤Ø³à¾×èͪèÇ»éͧ¡Ñ¹äÁèãËéàÇçºä«µì·ÕèÍÂÙèã¹â«¹ÍÔ¹à·ÍÃìà¹çµãËéàÃÕ¡ãªéʤÃÔ»µì µÑǤǺ¤ØÁ ActiveX ·Õè·Ó§Ò¹ÍÂÙè ËÃ×ÍàÃÕ¡ãªéà¹×éÍËÒÍ×è¹ æ damaging º¹¤ÍÁ¾ÔÇàµÍÃì¢Í§¤Ø³ ¢Ñé¹áá ¡Ó˹´¤ÇÒÁ»ÅÍ´ÀÑ¢ͧ⫹ÍÔ¹à·ÍÃìà¹çµ¢Í§¤Ø³ÁÕÃдѺ¡ÒäÇÒÁÅÐàÍÕ´Ê٧㹠Internet Explorer â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé:
  1. 㹡ÒÃà¤Ã×èͧÁ×ÍàÁ¹Ù ¤ÅÔ¡µÑÇàÅ×Í¡ÍÔ¹à·ÍÃìà¹çµ.
  2. ¤ÅÔ¡¡ÒáÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂá·çº ¤ÅÔ¡InternetáÅéÇ ¤ÅÔ¡ÃдѺ¡ÒÃàÃÔèÁµé¹.
  3. ᶺàÅ×è͹à¾×èͤÇÒÁÅÐàÍÕ´ÊÙ§áÅéÇ ¤ÅÔ¡µ¡Å§.
  ¢Ñ鹵͹¶Ñ´ä» à¾ÔèÁ url ÊÓËÃѺàÇçºä«µì·Õè¤Ø³àª×èͶ×Íŧã¹â«¹ä«µì·Õèàª×èͶ×Íä´é â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé:
  1. 㹡ÒÃà¤Ã×èͧÁ×ÍàÁ¹Ù ¤ÅÔ¡µÑÇàÅ×Í¡ÍÔ¹à·ÍÃìà¹çµ.
  2. ¤ÅÔ¡¡ÒáÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂá·çº
  3. ¤ÅÔ¡Trusted Sites.
  4. ¤Åԡ䫵ì.
  5. ¶éÒ䫵ì·Õè¤Ø³µéͧ¡ÒÃà¾ÔèÁäÁè¨Óà»ç¹µéͧµÃǨÊͺà«ÔÃì¿àÇÍÃì ¤ÅÔ¡à¾×èÍ¡àÅÔ¡¡Òõéͧ¡ÒõÃǨÊͺà«ÔÃì¿àÇÍÃì (https:)ÊÓËÃѺ·Ø¡ä«µìã¹â«¹¹Õé¡Åèͧ¡Òà¤Ã×èͧËÁÒÂ
  6. ¾ÔÁ¾ìÍÂÙè¢Í§àÇçºä«µì·Õè¤Ø³µéͧ¡ÒÃà¾ÔèÁŧã¹Trusted SitesÃÒ¡ÒÃ
  7. ¤ÅÔ¡add.
  8. ·Ó«éÓ¢Ñ鹵͹·Õè 6 áÅÐ 7 ÊÓËÃѺáµèÅÐàÇçºä«µì·Õè¤Ø³µéͧ¡ÒÃà¾ÔèÁ
  9. ¤ÅÔ¡µ¡Å§Êͧ¤ÃÑé§
• ÍèÒ¹¢éͤÇÒÁÍÕàÁÅã¹¢éͤÇÒÁÅéǹ
  
  ÊÓËÃѺ Outlook 2002 áÅÐ Outlook 2003:
  
  
  307594

  (http://support.microsoft.com/kb/307594/EN-US/ )

  OL2002: ¼ÙéãªéÊÒÁÒöÍèÒ¹ÍÕàÁÅ Nonsecure à»ç¹¢éͤÇÒÁÅéǹ
  831607

  (http://support.microsoft.com/kb/831607/EN-US/ )

  ÇÔ¸Õ¡Òô٢éͤÇÒÁÍÕàÁÅ·Ñé§ËÁ´ã¹ÃٻẺ¢éͤÇÒÁÅéǹ㹠Outlook 2003
  
  
  Outlook Express 6:
  291387

  (http://support.microsoft.com/kb/291387/ )

  OLEXP: ¡ÒÃãªé¤Ø³ÅѡɳСÒûéͧ¡Ñ¹äÇÃÑÊã¹ Outlook Express 6
  â´Â¡ÒÃÍèÒ¹ÍÕàÁÅ¢éͤÇÒÁÅéǹ ¤Ø³ÊÒÁÒö´Ù URL àµçÁ¢Í§¡ÒÃàª×èÍÁâ§ËÅÒÂÁÔµÔã´ æ áÅеÃǨÊͺÍÂÙè·Õè Internet Explorer ¨Ðãªé µèÍ仹Õé¤×ͺҧ¢Í§ÍÑ¡¢ÃзÕèÍÒ¨»ÃÒ¡¯¢Öé¹ã¹ URL ·ÕèÊÒÁÒö¹Óä»ÂѧàÇçºä«µì»ÅÍÁ:
  • % 00
  • % 01
  • @
• µÑÇÍÂèÒ§àªè¹ URL ¢Í§áºº¿ÍÃìÁµèÍ仹Õé¨Ðà»Ô´ http://example.com áµè URL ·Õè»ÃÒ¡¯ã¹·Õè·ÕèÍÂÙèᶺ¢Í§ Internet Explorer ÍÒ¨áÊ´§ http://www.wingtiptoys.com:
  http://www.wingtiptoys.com%01@example.com

ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺ·ÃѾÂÒ¡Ã Locators ¨ (url), áÇÐä»·Õè Word ¡ÇéÒ§àÇçº Consortium àÇçºä«µìµèÍ仹Õé:Microsoft ¨ÐãËé¢éÍÁÙŵԴµèͧ͢ºÃÔÉÑ·Í×è¹ à¾×èͪèÇÂãËé¤Ø³ÊÒÁÒö¢ÍÃѺ¡ÒÃʹѺʹع·Ò§à·¤¹Ô¤ä´é ¢éÍÁÙŵԴµè͹ÕéÍÒ¨à»ÅÕè¹á»Å§â´ÂäÁèµéͧá¨é§ãËé·ÃÒºÅèǧ˹éÒ Microsoft äÁèÃѺ»ÃСѹ¤ÇÒÁ¶Ù¡µéͧ¢Í§¢éÍÁÙÅ¡ÒõԴµè͡ѺºÃÔÉÑ·Í×è¹æ àËÅèÒ¹Õé