News

Microsoft Fixes IE 5 Bug

Microsoft has released a version upgrade that eliminates a vulnerability in Internet Explorer 5. Under certain conditions, the vulnerability could allow a malicious user to porvide proxy settings to Web clients in another network.

The Internet Explorer 5 Web Proxy Auto-Discovery (WPAD) feature enables Web clients to automatically detect proxy settings without user intervention. The algorithm used by WPAD adds the hostname "wpad" as a prefix to the fully-qualified domain name and progressively removes subdomains until it either finds a WPAD server answering the hostname or reaches the third-level domain. For instance, Web clients in the domain a.b.domain.com would query wpad.a.b.domain, wpad.b.domain.com, then wpad.domain.com. The vulnerability arises because in international usage, the third-level domain may not be trusted. A malicious user could set up a WPAD server and serve proxy configuration commands of his choice.

Microsoft Internet Explorer 5 is known to be affected by this vulnerability. The vulnerability is eliminated by Internet Explorer 5.01, which is available at http://www.microsoft.com/msdownload/iebuild/ie501_win32/en/ie501_win32.htm.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

comments powered by Disqus
Most   Popular

SharePoint Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.