Internet Explorer contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered by the improper handling of cached SSL contents, which will disclose information resulting in a loss in confidentiality It will also allow content on SSL-protected websites to be spoofed, resulting in a loss of integrity.

Install Microsoft security update MS04-038, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround:

Change advanced security settings to not save encrypted pages to disk.

1. In Internet Explorer, click Internet Options on the Tools menu.
2. Click the Advanced tab.
3. Under Settings, scroll to Security.
4. Under Settings, in the Security section, click Do not save encrypted pages to disk.
5. Click OK two times to return to Internet Explorer.

• Security Tracker: 1011642
• Related OSVDB ID: 10704 10705 10706 10707 10708 10710
• Secunia Advisory ID: 12806
• ISS X-Force ID: 17651
• CVE ID: 2004-0845 (see also: NVD)
• Microsoft Knowledge Base Article: 834707
• Microsoft Security Bulletin: MS04-038

• Mitja Kolsek - securityacrossecurity.com - ACROS Security