MS10-090: Cumulative security update for Internet Explorer

Known issues with this security update

Note The following issues are resolved by security update 2482017. For more information, click the following article number to view the article in the Microsoft Knowledge Base:



After you install this security update, you may also have to install update 2467659. To determine whether you have to install update 2467659, review the known issues in the following list:

• This security update contains a fix that turns off the automatic detection of Japanese Industrial Standard (JIS) encoding. However, some software uses a component in Internet Explorer to interpret Japanese email messages that are in HTML format. Therefore, the content of the email message may be displayed in unreadable code. This issue occurs because the JIS encoding is not automatically detected. To resolve this issue, install update 2467659.
  
  
• 
  When you print or view the Print Preview page of an affected webpage in Internet Explorer, garbled characters may appear on the Print Preview and on the printed documents. This issue occurs even if you press F5 to reload the website.
• 
  After you install this security update, you may be prompted to install this security update again when you scan the system by using Windows Update, Microsoft Update, Microsoft Windows Server Update Services (WSUS) server or Microsoft Baseline Security Analyzer (MBSA). This issue may occur if you installed this security update, but you have not installed update 2467659. To resolve this issue, approve the installation of update 2467659 in WSUS or install update 2467659 from Windows Update, Microsoft Update or from the Microsoft Download center.
  
  
  
  
• After you install this security update, some Japan Industrial Standard (JIS) websites may not appear correctly in Internet Explorer. This issue can occur if the JIS-based website does not specify JIS encoding in the HTTP headers. For example, the website only specifies JIS in a Meta tag.
  
  To work around this issue, use one of the following methods:
  

  Server-side workaround
  

  To work around this problem from the server-side, the website's administrator can configure the webpage to use the following HTTP header:
  

  Content-Type: text/html;charset=iso-2022-jp

  
  
  

  Client-side workarounds

  Use either of the following methods on the client computer to work around this issue:
  
  • To work around this issue while you are viewing the website, press F5 to refresh the page.
    
    
    
    
    
    
    
    
    
  • Alternatively, you can delete the Iexplore.exe and explore.exe registry DWORD entries from the registry on the client computer to unblock the JIS auto-detection.
    
    Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk. Specifically, if you delete the Iexplore.exe and explore.exe registry DWORD entries, the system may be more vulnerable to the security issues that are described in CVE-2010-3342 and CVE-2010-3348. For more information, see the following security bulletin:
    
    http://www.microsoft.com/technet/security/bulletin/MS10-090.mspx
    The security bulletin provides more information about the issue in the following sections:
    
    • Cross-Domain Information Disclosure Vulnerability - CVE-2010-3342
    • Cross-Domain Information Disclosure Vulnerability - CVE-2010-3348
    
    
    This information includes the following:
    
    • Mitigating Factors
    • Workarounds
    • FAQ
    ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
    322756 How to back up and restore the registry in Windows
    
    To delete the Iexplore.exe and Explore.exe registry DWORD entries, follow these steps:
    
    1. Click Start, type regedit in the Start Search box, and then click regedit.exe in the Programs list.
       
       
       If you are prompted for an administrator password or confirmation, type your password or click Continue.
    2. Locate and then click the following subkey in the registry:
       
       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_ISO_2022_JP_SNIFFING
       
    3. Right-click Iexplore.exe, and then click Delete.
    4. Click Yes to verify.
    5. Right-click Explore.exe, and then click Delete.
    6. Click Yes to verify.
    7. Exit Registry Editor, and then restart the computer.
    For more information about the FEATURE_DISABLE_ISO_2022_JP_SNIFFING registry subkey, see the following article in the Microsoft Knowledge Base:
    
    2467659 An update is available for Internet Explorer: December 14, 2010

Update 2467659

For more information about update 2467659, click the following article number to view the article in the Microsoft Knowledge Base:

To install update 2467659, visit the following Microsoft website:

Non-security-related fixes that are included in this security update

General distribution release (GDR) fixes

Individual updates may not be installed, depending on the version of Windows and the version of the affected application. Please view the individual articles to determine your update status.

Hotfixes

Security update 2416400 packages for Windows XP and for Windows Server 2003 include Internet Explorer hotfix files and general distribution release (GDR) files. If no existing Internet Explorer files are from the hotfix environment, security update 2416400 installs the GDR files.

Hotfixes are intended to correct only the problems that are described in the Microsoft Knowledge Base articles that are associated with the hotfixes. Apply hotfixes only to systems that are experiencing these specific problems.

These hotfixes may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains these hotfixes. For more information about how to install the hotfixes that are included in security update 2416400, click the following article number to view the article in the Microsoft Knowledge Base:

897225 How to install hotfixes that are included in cumulative security updates for Internet Explorer

NoteIn addition to installing hotfix files, review the Microsoft Knowledge Base article that is associated with the specific hotfix that you have to install to determine the registry modification that is required to enable that specific hotfix.

For more information about how to determine whether your existing Internet Explorer files are from the hotfix or from the GDR environment, click the following article number to view the article in the Microsoft Knowledge Base:

824994 Description of the contents of Windows XP Service Pack 2 and Windows Server 2003 software update packages