The task scheduler lets a network administrator assign authority to certain users to let them run code on client machines. The vulnerability permits a user to alter an existing job and have it executed, bypassing restrictions. The patch, also included in IE 5.01, requires that all jobs be digitally signed when they are created and be verified before execution. Microsoft credited Arne Vidstrom and Svante Sennmark for discovering the bug. In a buffer overrun, thought to be the most common form of computer security bug , an address field is vulnerable to flooding by an extremely long string of characters that can crash the computer.
Excess characters can wind up in memory, where they can be executed on restarting.
A description of the bug was posted to the Bugtraq security mailing list by Jeremy Kothe. The company also says it has 100,000 subscribers to its mailing list for notification of security problems and patches. The Windows Update site analyzes visiting computers and automatically updates browsers with the latest patches. We're rolling out patches quickly and broadly. We look into every report we get, and monitor the security mailing lists and the hacker sites, and whenever we get a report of a bug we build a patch for it.