This article was previously published under Q306121
This article has been archived. It is offered "as is" and will no longer be updated.
A vulnerability exists in Internet Explorer that could allow a Web site to take actions that it should not be able to take when you visit the Web site. Specifically, the vulnerability could allow the Web site to trick Internet Explorer into treating the page as though it were located on your intranet, thereby gaining the ability to use less-restrictive security settings than are appropriate. You could be affected by this vulnerability either by surfing to an attacker's Web site or by opening an HTML e-mail message from an attacker.
If the security settings are left in their default states, the additional privileges that the Web site would gain would still not allow the page to take any destructive action. The greater danger from this vulnerability occurs if you have given intranet sites additional latitude.
NOTE: The problem that is described in this article does not apply to Internet Explorer 6. However, the patch to which this article links also resolves two other problems that do affect Internet Explorer 6. If you are running Internet Explorer 6, you should apply this patch to resolve the two other issues.
For additional information about the two issues in Internet Explorer 6 that are resolved by the patch, click the article numbers below to view the articles in the Microsoft Knowledge Base:
286043 Patch Available for Telnet Logging Vulnerability
308414 Patch Available for HTTP Request Encoding Vulnerability
This vulnerability results because it is possible to refer to a Web site by using a particular type of "dotless" IP address. This causes Internet Explorer to handle the site in the Local Intranet zone rather than the correct zone.
Internet Explorer 5.5
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated Microsoft Security Bulletin to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now. Otherwise, wait for the next Internet Explorer 5.5 service pack that contains this fix.
To resolve this problem immediately, download the fix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:
NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The "Security Update, December 13, 2001" patch is superseded by the following patch:
316059 MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer
The "Security Update, December 13, 2001" patch is available at the following Microsoft Web site:
To resolve this problem, obtain the latest service pack for Internet Explorer 5.01 for Windows 2000. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
267954 How to Obtain the Latest Internet Explorer 5.01 Service Pack
Internet Explorer 5.5
Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.5.
Internet Explorer 5.01
Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.01. This problem was first corrected in Internet Explorer 5.01 for Windows 2000 Service Pack 3.
For more information about this vulnerability, visit the following Microsoft Web site: