SR News: Virus risk in MS Windows 98?


The publication "New Scientist" reported (in an article that was  quoted  in
papers around the world) that MicroSoft Windows 98 creates an exposure  that
would allow a virus to be received via HTML in an  email  using  JavaScript.
Padgette Peterson is  quoted  as  the  source  for  this  information.  This
publication didn't correctly  convey  the  information  that  was  known  to
Padgette and creates a misleading view of the security risk. There  actually
is a threat but it is not as reported in the  "New  Scientist"  article.  We
have been aware of the problem for some time but did not want  to  publicize
it any more than was necessary because of the risk that it would quickly  be
exploited by virus writers.

The real facts

Here is the situation in a nutshell. There is  an  exposure  that  currently
affects users of Windows Scripting  Host  (WSH)  and  the  beta  release  of
Windows 98. MicroSoft has indicated  they  will  fix  the  exposure  in  the
(expected June of 98) public release of Windows 98  (and  presumably  in  an
upcoming release of Windows Scripting Host). The threat  does  not  (as  was
reported) involve Java Applets. (If you  are  not  also  using  MS  Internet
Explorer, you are probably under no risk from this threat.)

The exposure

If you are currently using Windows 98 beta release or WSH with  Windows  95,
your PC's files can be damaged (this can include planting a  virus)  if  you
visit a web site that contains code designed to exploit this exposure.  This
exposure may extend to some mail readers that support HTML. To be  safe,  we
recommend that you not use the above software for web browsing  with  MS  IE
(Netscape does not seem to be affected). Uninstall or switch to a  different
configuration for web browsing. (At this point there is no  interim  fix  or
bypass available.) To keep things in perspective, we are not  aware  of  any
case where someone has exploited this exposure.


The latest status

The version of Windows 98  to  be  released  commercially  (presumably  very
soon!) is reported to have this exposure corrected. We do have a report that
the latest beta release still contains the problem, so please be careful  if
you are using any of the beta releases of Windows 98.

Write to Stiller Research: support@stiller.com

                                   Copyright c 1997-1998 Stiller Research.
                                    Document Last Modified May 12, 1998.

[=- 㡫  ୠ ᪨ 蠫 //  #2 //  1998  -=]
 -             L *.FRM "     h  /    >     M  "]  d*.MACk  o 0   s     "  "    ;O  