Microsoft fixes troubled IE patch

The flaw was discovered after users of IE 6 with Service Pack 1 reported that the browser crashed when certain Web pages were viewed. That crash turned out to be the result of a buffer overrun vulnerability introduced by the security update, Microsoft said earlier this week. The flaw could be exploited by cyberattackers, it said.

"The revised version (of the update)...fully resolves the security vulnerability," a Microsoft representative said in a statement sent via e-mail on Thursday.

The company originally set Tuesday for the release of a new version of the MS06-042 update that would fix the browser crash problem. However, it postponed delivery because of distribution problems. At the same time, eEye Digital Security disclosed that the crash was actually an exploitable security flaw, sending Microsoft scrambling to push the fixed patch out as soon as possible.

"Certainly, those are two events that we wish had not occurred, but we are learning from those situations, and we're going to work to make sure they don't happen again," Stephen Toulouse, a Microsoft Security Response program manager, said in an interview.

Microsoft sent out the initial MS06-042 security bulletin on Aug. 8, as part of its monthly patch cycle. The update, deemed "critical" by Microsoft, addresses eight flaws in the widely used browser. It is one of a dozen security updates in this month's Patch Tuesday batch.

"Everything with this Microsoft IE debacle was mistake after mistake," said Marc Maiffret, chief technology officer at eEye Digital Security, which publicly disclosed the security bug introduced by Microsoft's patch. "I would have to question who was in charge of strategy at Microsoft for the handling of this situation."

The patch trouble and the security issue only have an impact on users of IE 6.0 with SP1, which may run on Windows XP or Windows 2000. They do not affect other versions of IE, such as that in Windows XP with SP2 or in Windows Server 2003, Microsoft said. The company is urging affected users to download and install the new patch.

Already, the team that develops IE has documented the chain of events, including the code created by the developer who crafted the initial patch, Toulouse said. "They changed some of their tools and procedures," he said.

The developer responsible for the gaffe can expect to be held accountable, he added. "There are definite ramifications for situations like this," he said.

However, it is unclear what those action will be taken. "It is very complex," Toulouse said. An investigation into the error is ongoing.

There has been some debate about the reason behind the delay to the updated patch. Microsoft postponed it because of an error that would prevent certain patch management applications from distributing it, Toulouse said. The error was in the associated ".cab" file that contains update details used by those applications.

The patch would have been available on Windows Update and through patch management applications that do not use the ".cab" file, but users of Microsoft's patch management tools and other third-party tools would not have been able to deploy it, he said. These tools are used by organizations to do automated patch installations on multiple computers.

"Our goal is to protect all customers at the same time, and if we run into a situation where there is going to be a significant number of customers who are unable to deploy the update, we can't leave those customers behind," Toulouse said.