MicrosoftKB2416400MS10-090: Cumulative security update for Internet Explorer
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
<html><body><p>Resolves vulnerabilities in Internet Explorer that could allow remote code execution if a user views a specially crafted Web page using Internet Explorer.</p><h2></h2><div>The update that this article describes has been replaced by a newer update. To resolve this problem, install the most current cumulative security update for Internet Explorer. To install the most current update, visit the following Microsoft website:<br /><div><a href=“http://update.microsoft.com/microsoftupdate” target=“_self”>http://update.microsoft.com/microsoftupdate</a><br /></div> <br /> <br />For more technical information about the most current cumulative security update for Internet Explorer, visit the following Microsoft website:<br /><div><a href=“http://www.microsoft.com/technet/security/current.aspx” target=“_self”>http://www.microsoft.com/technet/security/current.aspx</a><br /></div><span><span>Important</span> This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect the computer. </span></div><h2>INTRODUCTION</h2><div>Microsoft has released security bulletin MS10-090. To view the complete security bulletin, visit one of the following Microsoft websites: <ul><li>Home users:<br /><div><a href=“http://www.microsoft.com/security/updates/bulletins/201012.aspx” target=“_self”>http://www.microsoft.com/security/updates/bulletins/201012.aspx</a></div><span>Skip the details</span>: Download the updates for your home computer or laptop from the Microsoft Update website now:<br /><div><a href=“http://update.microsoft.com/microsoftupdate/” target=“_self”>http://update.microsoft.com/microsoftupdate/</a></div></li><li>IT professionals:<br /><div><a href=“http://www.microsoft.com/technet/security/bulletin/ms10-090.mspx” target=“_self”>http://www.microsoft.com/technet/security/bulletin/MS10-090.mspx</a></div></li></ul><span><h3>How to obtain help and support for this security update</h3> <br />Help installing updates: <br /><a href=“https://support.microsoft.com/ph/6527” target=“_self”>Support for Microsoft Update</a><br /><br />Security solutions for IT professionals: <br /><a href=“http://technet.microsoft.com/security/bb980617.aspx” target=“_self”>TechNet Security Troubleshooting and Support</a><br /><br />Help protect your computer that is running Windows from viruses and malware:<br /><a href=“https://support.microsoft.com/contactus/cu_sc_virsec_master” target=“_self”>Virus Solution and Security Center</a><br /><br />Local support according to your country: <br /><a href=“https://support.microsoft.com/common/international.aspx” target=“_self”>International Support</a><br /><br /></span></div><h2>More Information</h2><div><h3>Known issues with this security update</h3><span>Note</span> The following issues are resolved by security update 2482017. For more information, click the following article number to view the article in the Microsoft Knowledge Base:<br /><div><a href=“https://support.microsoft.com/en-us/help/2482017”>2482017 </a> MS11-003: Cumulative security update for Internet Explorer</div> <br /><br /><br />After you install this security update, you may also have to install update <a href=“https://support.microsoft.com/help/2467659” target=“_self”>2467659</a>. To determine whether you have to install update 2467659, review the known issues in the following list:<br /><br /><br /><br /><br /> <ul><li>This security update contains a fix that turns off the automatic detection of Japanese Industrial Standard (JIS) encoding. However, some software uses a component in Internet Explorer to interpret Japanese email messages that are in HTML format. Therefore, the content of the email message may be displayed in unreadable code. This issue occurs because the JIS encoding is not automatically detected. To resolve this issue, install update <a href=“https://support.microsoft.com/help/2467659” target=“_self”>2467659</a>.<br /><br /></li><li> <br />When you print or view the Print Preview page of an affected webpage in Internet Explorer, garbled characters may appear on the Print Preview and on the printed documents. This issue occurs even if you press F5 to reload the website. </li><li><br />After you install this security update, you may be prompted to install this security update again when you scan the system by using Windows Update, Microsoft Update, Microsoft Windows Server Update Services (WSUS) server or Microsoft Baseline Security Analyzer (MBSA). This issue may occur if you installed this security update, but you have not installed update 2467659. To resolve this issue, approve the installation of update 2467659 in WSUS or install update <a href=“https://support.microsoft.com/help/2467659” target=“_self”>2467659</a> from Windows Update, Microsoft Update or from the Microsoft Download center.<br /><br /><br /><br /></li><li> After you install this security update, some Japan Industrial Standard (JIS) websites may not appear correctly in Internet Explorer. This issue can occur if the JIS-based website does not specify JIS encoding in the HTTP headers. For example, the website only specifies JIS in a Meta tag. <br /><br />To work around this issue, use one of the following methods:<br /><h4>Server-side workaround<br /></h4>To work around this problem from the server-side, the website’s administrator can configure the webpage to use the following HTTP header:<br /><div><pre><code>Content-Type: text/html;charset=iso-2022-jp</code></pre></div><br /><br /><h4>Client-side workarounds</h4>Use either of the following methods on the client computer to work around this issue:<br /><ul><li>To work around this issue while you are viewing the website, press F5 to refresh the page. <br /><br /><br /><br /><br /><br /><br /><br /><br /></li><li>Alternatively, you can delete the <span>Iexplore.exe</span> and <span>explore.exe</span> registry DWORD entries from the registry on the client computer to unblock the JIS auto-detection. <br /><br /><span><span>Warning</span> This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk. </span>Specifically, if you delete the <span>Iexplore.exe</span> and <span>explore.exe</span> registry DWORD entries, the system may be more vulnerable to the security issues that are described in CVE-2010-3342 and CVE-2010-3348. For more information, see the following security bulletin:<br /><div><a href=“http://www.microsoft.com/technet/security/bulletin/ms10-090.mspx” target=“_self”>http://www.microsoft.com/technet/security/bulletin/MS10-090.mspx</a></div>The security bulletin provides more information about the issue in the following sections:<br /><ul><li> Cross-Domain Information Disclosure Vulnerability - CVE-2010-3342 </li><li>Cross-Domain Information Disclosure Vulnerability - CVE-2010-3348</li></ul> <br /><br />This information includes the following:<br /><ul><li>Mitigating Factors</li><li>Workarounds</li><li>FAQ</li></ul><span><span>Important</span>This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: <div><a href=“https://support.microsoft.com/en-us/help/322756”>322756 </a>How to back up and restore the registry in Windows </div></span><br />To delete the <span>Iexplore.exe</span> and <span>Explore.exe</span> registry DWORD entries, follow these steps:<br /><ol><li>Click <strong>Start</strong><img alt=“Start button” src=“/library/images/support/kbgraphics/public/en-us/vistastartbutton.jpg” title=“Start button” />, type <span>regedit</span> in the <strong>Start Search</strong> box, and then click <strong>regedit.exe</strong> in the <strong>Programs</strong> list.<br /><br /><br /><img alt=“User Account Control permission” src=“/library/images/support/kbgraphics/public/en-us/securityshield.jpg” title=“User Account Control permission” /> If you are prompted for an administrator password or confirmation, type your password or click <strong>Continue</strong>. </li><li>Locate and then click the following subkey in the registry:<br /><div><strong>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_ISO_2022_JP_SNIFFING<br /></strong></div></li><li>Right-click <strong>Iexplore.exe</strong>, and then click <strong>Delete</strong>. </li><li>Click <strong>Yes</strong> to verify. </li><li>Right-click <strong>Explore.exe</strong>, and then click <strong>Delete</strong>. </li><li>Click <strong>Yes</strong> to verify. </li><li>Exit Registry Editor, and then restart the computer. </li></ol>For more information about the <span>FEATURE_DISABLE_ISO_2022_JP_SNIFFING</span> registry subkey, see the following article in the Microsoft Knowledge Base:<br /><div><a href=“https://support.microsoft.com/en-us/help/2467659”>2467659 </a> An update is available for Internet Explorer: December 14, 2010</div></li></ul></li></ul><h4>Update 2467659</h4>For more information about update 2467659, click the following article number to view the article in the Microsoft Knowledge Base:<br /><div><a href=“https://support.microsoft.com/en-us/help/2467659”>2467659 </a> An update is available for Internet Explorer: December 14, 2010</div><br />To install update 2467659, visit the following Microsoft website:<br /><div><a href=“http://update.microsoft.com” target=“_self”>http://update.microsoft.com</a></div><h3>Non-security-related fixes that are included in this security update</h3><h4>General distribution release (GDR) fixes</h4>Individual updates may not be installed, depending on the version of Windows and the version of the affected application. Please view the individual articles to determine your update status.<br /><div><table><tr><th>Article number</th><th>Article title</th></tr><tr><td><a href=“https://support.microsoft.com/en-us/help/2437070”>2437070 </a></td><td>A memory leak occurs when you use the WinINet API in an application to send HTTPS requests to a server</td></tr><tr><td><a href=“https://support.microsoft.com/en-us/help/925683”>925683 </a></td><td>In Internet Explorer 6 or in Internet Explorer 8, the OnChange event in a field does not occur when you change the “?” character to “ss” characters, or when you change “ss” characters to the “?” character</td></tr><tr><td><a href=“https://support.microsoft.com/en-us/help/975736”>975736 </a></td><td>A memory leak occurs when you open a Web page that contains a circular reference in an iframe</td></tr></table></div><h4>Hotfixes</h4>Security update 2416400 packages for Windows XP and for Windows Server 2003 include Internet Explorer hotfix files and general distribution release (GDR) files. If no existing Internet Explorer files are from the hotfix environment, security update 2416400 installs the GDR files. <br /><br />Hotfixes are intended to correct only the problems that are described in the Microsoft Knowledge Base articles that are associated with the hotfixes. Apply hotfixes only to systems that are experiencing these specific problems. <br /><br />These hotfixes may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains these hotfixes. <span>For more information about how to install the hotfixes that are included in security update 2416400, click the following article number to view the article in the Microsoft Knowledge Base: <div><a href=“https://support.microsoft.com/en-us/help/897225”>897225 </a>How to install hotfixes that are included in cumulative security updates for Internet Explorer </div></span><br /><span>Note</span>In addition to installing hotfix files, review the Microsoft Knowledge Base article that is associated with the specific hotfix that you have to install to determine the registry modification that is required to enable that specific hotfix. <br /><br /><span>For more information about how to determine whether your existing Internet Explorer files are from the hotfix or from the GDR environment, click the following article number to view the article in the Microsoft Knowledge Base: <div><a href=“https://support.microsoft.com/en-us/help/824994”>824994 </a>Description of the contents of Windows XP Service Pack 2 and Windows Server 2003 software update packages </div></span></div><h2>Fix it for me</h2><div><a></a>The Fix it solutions that are described in this section are not intended to be replacements for any security updates. We recommend that you always install the latest security updates. However, we offer the Fix it solutions as workaround options for some scenarios. These Fix it solutions help to resolve the security issue described in CVE-2010-3962. For more information about the security issue and the workarounds, visit the following Microsoft Security Bulletin webpage:<br /><div><a href=“http://www.microsoft.com/technet/security/bulletin/ms10-090.mspx” target=“_self”>http://www.microsoft.com/technet/security/bulletin/MS10-090.mspx</a></div>The security bulletin provides more information about the issue in the “Uninitialized Memory Corruption Vulnerability - CVE-2010-3962” section. This information includes the following:<br /><ul><li>Mitigating Factors</li><li>Workarounds</li><li>FAQ</li></ul>Two Fix it solutions are available: <br /><br /><ul><li><span>Fix it solution for the user-defined CSS</span><br />A Fix it solution is available that enables supported versions of Internet Explorer to override a website’s cascading style sheets style by using a custom CSS for formatting documents. <br /><br />To remove the user-defined CSS and to restore the original settings, click the <strong>Fix it</strong> button or link under the <strong>Remove User-Defined CSS</strong> heading in the “<a href=”#fixitforme1" target>Fix it solution for the user-defined CSS</a>" section. <br /></li><li><span>Fix it solution for Data Execution Prevention in Internet Explorer 7</span><br />We have created an application compatibility database that will enable Data Execution Prevention (DEP) for all versions of Internet Explorer that support DEP.<br /><br /><br />To install this application compatibility database, click the <strong>Fix it</strong> button in the “<a href=”#fixitformealways" target>Fix it solution for Data Execution Prevention in Internet Explorer 7</a>" section.</li></ul><a></a><h3>Fix it solution for the user-defined CSS</h3>To enable or to disable the user-defined CSS workaround automatically, click the <strong>Fix it</strong> button or link under the <strong>Apply User-Defined CSS</strong> heading or under the <strong>Remove User-Defined CSS</strong> heading. Click <strong>Run</strong> in the <strong> File Download</strong> dialog box, and then follow the steps in the Fix it wizard. <br /><div><table><tr><th>Apply User-Defined CSS</th><th>Remove User-Defined CSS</th></tr><tr><td><span><div></div></span></td><td><span><div></div></span></td></tr></table></div><br /><span>Notes</span><ul><li>These wizards may be in English only. However, the automatic fixes also work for other language versions of Windows. </li><li>If you are not logged on to the computer that has the problem, you can save the automatic fix to a flash drive or to a CD and then run the automatic fix on the computer that has the problem. </li><li>If you decide not to install the current security update and instead choose to use the workaround that is described in security bulletin MS10-090, you can click the <strong>Fix it</strong> button to enable or to disable applying the user-defined CSS. </li></ul><h4>Known issues with the Fix it solution for the user-defined CSS</h4><ul><li>In some scenarios, Group policy may block this Fix it solution from being installed on systems that are running Windows Server 2008 or Windows Server 2008 R2. When the issue occurs, you may receive an error message that resembles the following: <br /><div>The system administrator has set policies to prevent this installation.<br /></div><br />Contact the system administrator for more information about how to change the policy to allow the installation. </li><li>You may be unable to install this fixit solution if a <span>Styles</span> registry subkey exists in the following location in the registry:<br /><div><strong>HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles<br /></strong></div>To resolve this issue, remove the <span>Styles</span> registry subkey, and then install the Fix it. <br /><br /><span>Note</span> you can export the <span>Styles</span> registry subkey, and then re-import the key after you install the fixit solution. To do this, follow these steps:<br /><ol><li>Right-click the <span>Styles</span> registry subkey, and then click <span>Export</span>. </li><li>Type a name for the temporary .REG file, and then save it to the desktop. </li><li>Right-click the <span>Styles</span> registry subkey, and then click <span>Delete key</span>. Click <span>Yes</span> to verify. </li><li>Install the fixit solution. </li><li>Double-click the temporary .REG file that you saved on the desktop to import the registry subkey. Click <span>Yes</span> to verify. </li></ol></li></ul><a></a><h3>Fix it solution for Data Execution Prevention in Internet Explorer 7</h3>To enable or to disable DEP automatically in Internet Explorer 7, click the <strong>Fix it</strong>button or link. Click<br /><strong>Run</strong>in the<br /><strong> File Download</strong>dialog box, and then follow the steps in the Fix it wizard. <br /><div><table><tr><th>Enable the application compatibility database</th><th>Disable the application compatibility database</th></tr><tr><td><span><div></div></span></td><td><span><div></div></span></td></tr></table></div><span>Notes</span><ul><li>You do not have to have this database if you are using Internet Explorer 8 on Windows XP Service Pack 3 (SP3), on Windows Vista SP1, or on later versions of Windows. This is because Internet Explorer 8 opts-in to DEP by default on these platforms. </li><li>If you decide not to install the current security update and instead decide to use the workaround that is described in MS10-018, you can click the <span>Fix it</span> button to enable or to disable DEP. Then, click <strong>Run</strong> in the <strong>File Download</strong> dialog box, and follow the steps in the wizard. </li><li>These wizards may be in English only. However, the automatic fixes also work for other language versions of Windows. </li><li>If you are not logged on to the computer that has the problem, you can save the Fix it solution to a flash drive or to a CD and then run the Fix it solution on the computer that has the problem. </li><li>For this workaround to be effective, your processor must support hardware-enforced DEP. <span>For more information about how to determine whether your system supports hardware-enforced DEP, click the following article number to view the article in the Microsoft Knowledge Base:<br /><div><a href=“https://support.microsoft.com/en-us/help/912923”>912923 </a>How to determine that hardware DEP is available and configured on your computer<br /></div></span></li></ul></div><h2>FILE INFORMATION</h2><div><a></a><br /><br /><br /><br />For a list of files that are provided within these packages, click the following link: <br /><br /><div><a href=“http://download.microsoft.com/download/c/a/7/ca7ac20a-a2d2-41e1-90af-a259a8f8bf73/file attributes tables for security update 2416400.csv” target=“_self”>File attributes tables for security update 2416400.csv</a></div> <br /><br /><br /><br /><br /><br />If you are not sure which version of Windows that you are running or whether it is a 32-bit version or 64-bit version, open System Information (Msinfo32.exe), and review the value that is listed for <strong>System Type</strong>.<br /><br /><br /><br />You must know which kind of processor platform (x86-based, x64-based, or Itanium-based) that you have. Most users have x86-based processors. If you are not sure which kind of processor platform you have, install the x86-based update on the computer. To do this, follow these steps: <ol><li>Click <strong>Start</strong>, and then click <strong>Run</strong>, or click <strong>Start Search</strong>. </li><li>Type <strong>msinfo32.exe</strong> and then press ENTER. </li><li>In <strong>System Information</strong>, review the value for <strong>System Type</strong>.<br /><ul><li>For 32-bit editions of Windows, the <strong>System Type</strong> value is <strong>x86-based PC</strong>. </li><li>For 64-bit editions of Windows, the <strong>System Type</strong> value is <strong>x64-based PC</strong>. </li></ul></li></ol><h4>Video: How to determine whether you are running a 32-bit or a 64-bit edition of Windows </h4><span><iframe frameborder=“0” height=“360” marginheight=“0” marginwidth=“0” scrolling=“no” src=“https://hubs-video.ssl.catalog.video.msn.com/hub/ShowcaseMSN2?csid=ux-cms-en-us-msoffice&iframe=true&uuid=f4bdcc15-c0f6-4f72-9bc4-ab031ec43612&PlaybackMode=inline&Quality=HQ&AutoPlayVideo=false&width=640&height=360” width=“640”></iframe></span><br /><span><br /><br />For more information about how to determine whether you are running a 32-bit or 64-bit edition of Windows, click the following article number to view the article in the Microsoft Knowledge Base:<br /><div><a href=“https://support.microsoft.com/en-us/help/827218”>827218 </a>How to determine whether a computer is running a 32-bit version or a 64-bit version of the Windows operating system<br /></div></span></div></body></html>
Related
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C