Microsoft Issues Critical Security UpdateMicrosoft Issues Critical Security Update

Microsoft on Monday issued a critical security update for Internet Explorer, versions 5.01 and up, to address three serious vulnerabilities. The affected versions of Windows include NT 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Windows Server 2003.

The update, Security Update 832894, is detailed in Security Bulletin MS04-004. It repairs a vulnerability that could let an attacker execute potentially damaging code on a user's system. It also fixes a flaw known as "phasing" by which an attacker could spoof a Web-site address, a tactic typically employed to capture personal information revealed by unsuspecting visitors. It also deals with a third problem, by which an attacker could trick a user into saving unauthorized code on his or her system.

Microsoft considered the issues addressed in this update serious enough to warrant this unscheduled, or out-of-cycle, patch, says Mike Reavey, security program manager at the Microsoft Security Response Center. "We did this in response to the particular nature of this vulnerability--the URL-spoofing issue," he says. "And also there was a lot of customer feedback about this. While we like to maintain a predictable schedule, with this particular issue we released it as soon as it was ready."

In keeping with its "Protect Your PC" campaign, Microsoft continues to urge users to employ an Internet firewall, keep software up to date, and use antivirus software.