Re: IE 5.5 SP2 Failure Final Update...RE-VISITED 2006...

  •  04-13-2006, 11:24 AM

    Re: IE 5.5 SP2 Failure Final Update...RE-VISITED 2006...

    I've actually ran into this problem.  This is a custom version of IE.  You can tell because the version ends in 'CO'.  The problem with customized version of IE, especially with 5.5, is that that to keep the customization certain DLL are marked as read-only, do not update.  Not matter how many updates you run, the customized DLL will not update.  Dell was well know for creating custom versions which had a Dell throbber and lock you into using a branded search page. 

    Unfortunately, people who have these customized versions have gapping security hole and don't even know it.  There is a VBS/JScript function called getobject() which will allow nefarious websites to quietly install ActiveX controls.  Microsoft came out with a partial patch, and then withdrawn it in few days.  The patch turned off all scripting and removed all security zones, sometimes making a client’s machine unusable.

    So what does this mean for Cute Editor?  IMHO I really don't think Cute Soft can do anything about it.  Those custom DLL's may have scripting functions removed or changed in ways that only the original programmer from 5 years ago would know about.  To be honest Cute Soft most likely didn't know about this issue.  Microsoft didn't formally acknowledge this issue, they just issued low level security advisories and said don't use custom version of IE, they're not cover in your ULA. 

    As a side note, Microsoft changed the way they allowed customization after 6.0.26XX (the first public version of IE 6.) IE 6.0.2600.0000CO has the same issues as 5.50.4807.2300CO.

View Complete Thread