Microsoft offers early fix for critical IE bug
2243
(InfoWorld) - With attackers finding new ways to exploit aÂ critical flaw in Internet Explorer, Microsoft Corp. has released a patch for the problem, ahead of its next scheduled round of security updates. The patch fixes a critical vulnerability in the way Internet Explorer renders VML (Vector Markup Language) graphics. Hackers had been exploiting the flaw, which also affectsÂ some versions of Outlook, for more than a week, and in recent days malicious activity had been on the upswing. More information on the update, which was released Tuesday, can be foundÂ here. The out-of-cycle release is unusual, but not unprecedented. Microsoft generally releases its security updates on the second Tuesday of every month, giving system administrators a predictable way to set aside time to test the new software. Occasionally, the company will release patches ahead of time if a flaw is being widely exploited by attackers. In January itÂ patched a critical flaw in the Microsoft Windows Metafile (WMF) image-rendering engine after it became a widespread problem. With attack code that works on the latest version of Windows XP now publicly available, the VML bug is shaping up as a very serious concern for administrators, said Ken Dunham, the director of Verisign Inc.'s iDefense Rapid Response Team. VML attacks have now "dwarfed the WMF activity in the same period of time compared to last year," he said. By Tuesday, more than 3,000 Web sites were already infecting users with malware that exploited the VML bug, according to Dunham. One week into the WMF outbreak last January, iDefense saw about 600 sites exploiting the problem. Security experts also warn that there are many variants of the VML malware, some of which may be missed by security software. Researchers at iDefense are now looking at a dozen possible variations of the VML exploit code and have confirmed the existence of seven variants, Dunham said. "With WMF there wasn't nearly as much modification. We see a lot of different permutations and obfuscation techniques being utilize with VML attacks." AÂ group of security researchers released a patch for the VML flaw late last week, independent of Microsoft, but criminals have even found a way to exploit the fix. In the past few days they have been circulating phoney e-mails, claiming to be a patch for the VML problem. If downloaded, this fake patch actually installs malicious software on the victim's system, Dunham said. Microsoft's next regularly scheduled security updates will be released Oct. 10. Â ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
294028
Â Microsoft is investigating reports of a serious security flaw in Internet Explorer (IE), but has not yet seen malicious code that exploits the reported flaw, the company said Thursday.
235692
Microsoft's recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.
184682
Microsoft has issued a formal fix for a problem in Windows XP Service Pack 2 that appeared almost immediately after the update&#39;s release.
89850
Microsoft has a technical work-around for users who found IE crashing after recent security update.
530951
Out-of-band Microsoft is considering plans to release an unscheduled security patch to address a serious security vulnerability in its ubiquitous Internet Explorer web browser.â¦
524507
A variant of a bug that uses an Internet Explorer 6 vulnerability exposes Microsoft Windows systems patched with Service Pack 2. A security researcher claims to have crafted a simpler version of a bug first identified in late October.
314789
Recent updates to IE contain a serious regression that leaves systems once more vulnerable to a flaw fixed more than two years ago, according to security researchers.
411778
Microsoft has offered a technical workaround for Internet Explorer users who have found their browsers crashing after installing a recent set of security patches.Last Tuesday,&#160;Microsoft issued a critical security update for its browser software, fixing bugs in the browser. But soon after, users began reporting that IE would crash while visiting certain Web sites. These users would be forced to restart the browser after receiving an &quot;Internet Explorer has encountered a problem and must close&quot; message.Microsoft now says that the problem is not widespread and affects certain custom installations of Internet Explorer 6 on Windows XP, Service Pack 2.Customers who experience this problem can fix it by making changes to the Windows registry, described in this Knowledge Base article.Microsoft did not say what kind of customization would cause the bug, and company representatives were not immediately available for comment.Some newsgroup users are speculating, however, that the issue may be related to antivirus software. Symantec and McAfee users who have been experiencing the problem have been able to resolve the issue by uninstalling the security update and then uninstalling their antivirus software, installing the update and then reinstalling their AV products, said Frank Saunders, a Windows user who has been following discussion of the issue.The Internet Explorer patch associated with this problem -- MS07-069 -- is considered to be the most important of last week&#39;s updates because it fixes four critical vulnerabilities in the browser.
549045
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft has offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
166415
Microsoft has released an update to Internet Explorer to fix a security flaw that was discovered a month ago and has since been exploited to attack users.
257602
In the latest incident of a now-chronic problem that has been bugging Microsoft all year, a recent security patch now causes IE6 to crash in Windows XP...again.
389013
Zombie Armageddon averted Microsoft has broken its normal release schedule to publish a security patch to address a critical vulnerability in Internet Explorer that has become the target of widespread hacking attacks.â¦
268907
Microsoft is investigating reports of a serious security flaw in Internet Explorer, but has not yet seen malicious code that exploits the reported flaw, the company said today.
502357
Meanwhile, a second unofficial fix is out as attacks on Internet Explorer users are reportedly increasing.
535582
More than two months after HD Moore's "Month of Browser Bugs," Microsoft is still scrambling to patch most of the 22 IE vulnerabilities revealed in July -- not to mention the 70 others Moore found in August.
745224
Security experts uncovered yet another bug in Internet Explorer this week, one that could let attackers replace the content of any legit site with their own, making it possible to spoof critical pages such as e-bank account access log-in forms or credit