JavaScript patch is not applied
| java-script-patch (1276) |  High Risk |
Description:
The JScript patch is not applied. This means your system is vulnerable to malicious intent over the Internet. Microsoft Internet Explorer versions 4.0, 4.01 and 4.01 SP1 use JScript Scripting Engine version 3.1 to process scripts on a Web page.
When Internet Explorer encounters a Web page that uses JScript script to invoke the Window.External function with a very long string, Internet Explorer or Windows 98 could terminate. In addition, a skilled hacker could use this malicious script message to run arbitrary computer code contained in the long string.
Consequences:
Gain Access
Remedy:
Apply the scripting patch, as listed in Microsoft Security Bulletin MS98-011. See References.
— OR —
Disable Active Scripting in the "Untrusted" and "Internet" zones.
To disable Active Scripting:
- Open Internet Explorer 4.x.
- From the View menu, choose Internet Options.
- Click the Security tab.
- Under Internet Zone, click Custom (for expert users).
- Click Settings.
- Under Scripting, navigate to Active scripting.
- Click Disable.
- Click OK.
References:
- Microsoft Internet Explorer Support: Window.External" JScript Vulnerability.
- Microsoft Knowledge Base Article 191200: Update Available for Window.External JScript Security Issue.
- Microsoft Security Bulletin MS98-011: Update available for 'Window.External' JScript Vulnerability in Microsoft Internet Explorer 4.0.
- Microsoft Windows Script Technologies: Windows Script 5.0.
- CVE-1999-1093: Buffer overflow in the Window.External function in the JScript Scripting Engine in Internet Explorer 4.01 SP1 and earlier allows remote attackers to execute arbitrary commands via a malicious web page.
Platforms Affected:
- Microsoft Windows 2000
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
Reported:
Aug 17, 1998
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net