Microsoft has released updates for Internet Explorer and Outlook Express for the Mac. The new versions, 4.5.1, and 5.0.1 respectively, fix several serious security issues with the Internet. Some of these bugs would have caused the products to no longer function after the new year. According to Microsoft:
Internet Explorer 4.51-Outlook Express 5.01
Internet Update is comprised of a patch for Internet Explorer 4.5 and Outlook Express 5 for the Macintosh. Users who downloaded the new Outlook Express 5 and/or Internet Explorer 4.5 prior to December 21, 1999, are affected and will need to download the Internet Explorer 4.51-Outlook Express 5.01 Internet Update.
Below are the issues addressed in this Internet Update:
Internet Explorer 4.5 certificates security issue
This patch addresses the Internet Explorer security issue citing that certain certificates, which provide user security, will expire at midnight on December 31, 1999, and accessing them after that date will generate an "expired certificate" warning. For sites using certificates, behavior will be normal up to and including 12/31/1999. The problem will not exhibit itself until after midnight on 12/31/1999. If a user connects to a site using certain certificates, Internet Explorer will display the following dialog statement:
"Unable to establish a secure connection to (Site). There is a problem with the security certificate from that site (The identity certificate has expired.) The information you view and send will be readable to others while in transit, and it may not go to the intended party. Continue loading this page?"
The user has the option of continuing with the connection, but Internet Explorer will not display the visual cue (a lock icon will not appear) that indicates a secure connection. The user also has the option of stopping the connection.
JavaScript errors in Internet Explorer and Outlook Express
Internet Explorer 4.51-Outlook Express 5.01 Internet Update provides a fix for the issue occurring when users try to enter sites that require JavaScript using Internet Explorer, such as Citibank, where they may experience an error upon entering them. The problem affects only people who have recently downloaded Outlook Express 5 Macintosh Edition and use Internet Explorer. Internet Explorer and Outlook Express share libraries to reduce the size of the applications. Outlook Express 5's recent release included a new JavaScript library that is the cause of people not being able to enter certain sites.
Outlook Express 5's security issue
Also fixed is the security issue in Outlook Express 5, which makes it possible for a malicious sender to send an MHTML message to an Outlook Express 5 user, which would then automatically download a file to the user's default Download folder without the Outlook Express 5 user's knowledge. (The location of the default Download folder is set in Internet Explorer or Internet Config.) The downloaded file could be anything, including an executable. The user has to explicitly take action (opening the attachment, or in this case, opening the downloaded file) in order for any damage to occur - the file is NOT automatically opened or executed on the user's machine. Since the user is not aware that the file has been downloaded, the user may encounter the file later and open/launch it. Since the file can be an executable, launching it could cause damage to the user's machine. Users should NEVER open any file in the Downloads Folder unless they know where the file came from.
We encourage all users of Outlook Express 5 and Internet Explorer 4.5 to download the Internet Explorer 4.51-Outlook Express 5.01 Internet Update to ensure a continued seamless and secure Internet experience. Please read all the FAQs regarding these issues if you have more questions.
We concur with Microsoft wholeheartedly that these upgrades are highly recommended. We also would like to encourage all Observers who use these apps to download these updates ASAP. You can find more information on the products and the updates as Microsoft's web site. Download links are also available.