--------------------------------------------------------------------------------




The following is a Security  Bulletin from the Microsoft Product Security

Notification Service.



Please do not  reply to this message,  as it was sent  from an unattended

mailbox.

                    ********************************



Microsoft Security Bulletin (MS99-037)

--------------------------------------



Patch Available for "ImportExportFavorites" Vulnerability

Originally Posted: September 10, 1999



Summary

=======

Microsoft has learned of a vulnerability in Microsoft Internet Explorer 5

that could allow a  malicious web site operator to take inappropriate action

on the computer of a person who visited  the site. Customers can immediately

protect themselves against this vulnerability by disabling  Active Scripting

in IE 5, as discussed in the FAQ. Microsoft also is developing a patch that

will  restore safe operation to the affected feature; when the patch is

available, this bulletin will  be re-released.



Frequently asked questions regarding this vulnerability can be found

at http://www.microsoft.com/security/bulletins/MS99-037faq.asp



Issue

=====

IE 5 includes a feature that allows users to export a list of their favorite

web sites to a file,  or to import a file containing a list of favorite

sites. The method that is used to perform this  function,

ImportExportFavorites(), should only allow particular types of files to be

written, and  only to specific locations on the drive. However, it is

possible for a web site to invoke this  method, bypass this restriction and

write files that could be used to execute system commands.  The net result

is that a malicious web site operator potentially could take any action on

the  computer that the user would be capable of taking.



This vulnerability would chiefly affect workstations that are connected to

the Internet. As an  immediate measure, customers can prevent the

ImportExportFavorites function from operating by  disabling Active

Scripting, as discussed in the FAQ. A patch that restores correct operation

is  under development and will be delivered shortly.



Affected Software Versions

==========================

 - Microsoft Internet Explorer 5



Workaround

==========

The vulnerability can be prevented by disabling Active Scripting. The FAQ

contains details on how  to do this.



More Information

================

Please see the following references for more information related to this

issue.

 - Microsoft Security Bulletin MS99-037: Frequently Asked Questions,

   http://www.microsoft.com/security/bulletins/MS99-037faq.asp.

 - Microsoft Security Advisor web site,

   http://www.microsoft.com/security/default.asp.



Obtaining Support on this Issue

===============================

Information on contacting Microsoft Technical Support is available

at http://support.microsoft.com/support/contact/default.asp.



Acknowledgments

===============

Microsoft acknowledges Georgi Guninski for bringing this issue to our

attention.



Revisions

=========

 - September 10, 1999: Bulletin Created.



-------------------------------------------------------------------------



THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"

WITHOUT WARRANTY OF  ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER

EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES  OF MERCHANTABILITY AND FITNESS

FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION  OR ITS

SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,

INCIDENTAL,  CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,

EVEN IF MICROSOFT CORPORATION OR ITS  SUPPLIERS HAVE BEEN ADVISED OF THE

POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE  EXCLUSION OR

LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE

FOREGOING  LIMITATION MAY NOT APPLY.



(c) 1999 Microsoft Corporation. All rights reserved. Terms of Use.



   *******************************************************************

You have received  this e-mail bulletin as a result  of your registration

to  the   Microsoft  Product  Security  Notification   Service.  You  may

unsubscribe from this e-mail notification  service at any time by sending

an  e-mail  to  MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM

The subject line and message body are not used in processing the request,

and can be anything you like.



For  more  information on  the  Microsoft  Security Notification  Service

please visit http://www.microsoft.com/security/services/bulletin.asp. For

security-related information  about Microsoft products, please  visit the

Microsoft Security Advisor web site at http://www.microsoft.com/security.