Security concerns put MSN Messenger beta on hold
100092
Microsoft has suspended the beta testing of the next version of its MSN Messenger client because of a potential security problem, a company spokeswoman said Wednesday.
341692
Users of Microsoft Corp. (MSFT.O: Quote, Profile, Research) MSN Messenger lost the ability to swap instant messages for a brief period, the world&#39;s largest software maker said on Tuesday.
609245
InfoWorld - Microsoft is forcing Windows Live and MSN Messenger users to upgrade to the newest version due to a security update included in that release, according to a posting on a Microsoft blog.
411146
Six high priority updates, in all Microsoft is to issue four critical security fixes for this month's Patch Tuesday. Three of these affect either Windows Vista or Internet Explorer 7, which the software maker holds out as a paragon of its conversion to secure computing. In all, Microsoft will push six high-priority updates this Tuesday, the company announced today.â¦
163742
(InfoWorld) - Microsoft is forcing Windows Live and MSN Messenger users to upgrade to the newest version due to a security update included in that release, according to a posting on a Microsoft blog. Anyone using 6.2, 7.0 and 7.5 versions of MSN Messenger or Windows Live Messenger 8.0 will be guided through the upgrade process to Windows Live Messenger 8.1 when they try to log in to their chat client, according to a blog posting by a security product manager at Microsoft calling himself "Anand." This will replace the option upgrade notice that users have been given when using those versions of the product since January, he wrote. "Some of you might feel this inconvenient, but in order to protect you and protect the health of the network, we have chosen to take this step," the blog entry said. The Messenger vulnerability, which let hackers embed malicious code in Web chat invitations to users, was disclosed in August. It affected MSN Messenger versions 6.2, 7.0, and 7.5, as well as Windows Live Messenger 8.0. Microsoft changed the name of its popular chat client from MSN to Windows Live with version 8.0. Microsoft patched the problem in older versions of Messenger as part of its monthly round of patches on Tuesday, which means users of affected versions of Messenger theoretically could install the patch and protect themselves. In its security bulletin for the patch, the company recommended Windows XP and Vista users upgrade to Windows Live Messenger 8.1, but only suggested in a vague way that they might order a mandatory update. "If you do not upgrade to a non-affected version of the MSN Messenger or Windows Live Messenger client, depending on your platform, you will be notified to upgrade on each attempt to sign on," the company said in Tuesday's security bulletin. "If you do not accept the upgrade, you may not be allowed access to MSN Messenger or Windows Live Messenger service." The company apparently changed its mind Wednesday, which is when the posting that disclosed the mandatory upgrade hit the Web. Users who commented on Anand's blog post had mixed opinions on the decision. One post complained that the user had "tried using Windows Live Messenger before and found that it simply takes up too much of my system's resources!" However, another said it was "a good decision," while still another said he was running Windows Live Messenger 8.5 in beta form and "it's not even that buggy." Microsoft's decision to force upgrades brings to mind complaints raised several months ago by users of AIM (AOL Instant Messenger) that AOL was encouraging users a little too insistently to upgrade from AIM 6.0 to 6.1. Users were angry about upgrade alert messages displayed on AIM screens that could not be turned off and would continue to reappear and interrupt current IM activity even after a user had closed the dialogue box.
691908
(InfoWorld) - Microsoft has released its security patches for September, fixing known vulnerabilities in its MSN Messenger software and Unix services for Windows as well as a critical bug in Windows 2000. In total, Microsoft patched four bugs in its products. This was one less update than expected following the software maker's last-minute decision to scrap a fix for its SharePoint collaboration software. The Windows 2000 update is the only one Microsoft rates as critical. It affects the Microsoft Agent software that Web developers use to create interactive characters on Web pages. By tricking a Windows 2000 user into visiting a maliciously encoded Web page, an attacker could exploit this flaw to run unauthorized software on a victim's computer. This is not the first time Microsoft has been forced to patch a critical bug in Microsoft Agent. In April, the company fixed a similar flaw that also affected Windows XP users. Because the MSN Messenger and Windows Services for Unix flaws were both publicly disclosed last month, they should also be given priority said Amol Sarwate, manager of Qualys's vulnerability research lab. "They had both been known for awhile, but they are important," he said. "Especially the MSN vulnerability." MSN Messenger and Windows Live Messenger users will be prompted to upgrade their software when they connect with Microsoft's instant-messaging services, Microsoft said in its notes on the security update. "If you do not upgrade to a non-affected version of the MSN Messenger or Windows Live Messenger client, depending on your platform, you will be notified to upgrade on each attempt to sign on." MSN Messenger 7.0.0820 or Windows Live Messenger 8.1 are not vulnerable to the flaw, Microsoft said. The fourth patch issued Tuesday fixes a bug in Crystal Reports for Visual Studio. Attackers could run code on a victim's PC by getting them to open a specially crafted Crystal Reports RPT file, Microsoft said. Overall, the September updates are a far less serious group of patches than the nine updates Microsoft released last month. "Compared to last month, Patch Tuesday in September is almost anticlimactic," security vendor McAfee said in a statement. "Customers who have legacy applications installed on Windows Server 2000 Service Pack 4 should be paying the most attention, but we don't foresee a lot of exploitation of the Windows 2000 vulnerability. Not many people will use those systems to surf the Web, which would be the attack vector."
733386
Microsoft has suspended a test release of its ballyhooed algorithmic search engine from the MSN Sandbox Web site. A note on MSN's Web page read that the product team had solicited enough feedback to launch another preview later on this year. In the meantime, users are encouraged to make use of the existing MSN search service.
422758
Yet another zero-day flaw affecting Yahoo Messenger has been posted online, bringing to nine the number of such vulnerabilities aimed at the IM software this year.
381793
Beta application is available as part of the new MSN Toolbar Suite.
726036
Yahoo Messenger Patches Security Hole  If you logged into Yahoo Messenger today and was taken a back by an automatic security download - don't be scared, it's no virus. Yahoo was only patching up a few holes.  Yahoo has posted a security patch for a flaw in its instant messaging software that ...
42081
Blog: Popular add-ons could have their update process hijacked by man-in-the-middle attacks.
22372
Blog: Yahoo IM fixed after temporary problems
662074
(InfoWorld) - Yahoo has fixed a serious vulnerability in its Messenger instant messaging client. The patch, posted Thursday, fixes a critical flaw in the ActiveX control used by Messenger's Webcam feature. According to security experts, this flaw could be exploited by hackers to install unauthorized software on a victim's PC. The patch came after two sample attacks that exploited the vulnerability were posted to the Full Disclosure security discussion list. EEye Digital Security first reported the issue on Wednesday without disclosing specific details of the bug. The security vendor considers the flaw to be serious. "ActiveX remote code execution vulnerabilities have very high impacts because the source of the malicious payload can be any site on the Internet," eEye said in its alert. This is the third time in recent months that Yahoo has had to patch an ActiveX control flaw in Messenger. It patched these other bugs in March and December.
55391
Microsoft released a &quot;critical&quot; fix on Thursday for a security issue left unresolved by the Windows XP Service Pack 2. The configuration change closed a hole in the Windows firewall settings that could open
694997
This Web-savvy update syncs with MSN accounts, but you'll want to be aware of some functionality requirements and service limitations.
356210
Citing a vulnerability made public earlier this week, Microsoft is requiring users of older versions of its MSN Messenger IM client to update to Windows Live Messenger 8.1 -- unless they're running Windows 2000.
27911
Nothing to see here, please move along Microsoft announced on Thursday that doesn't plan to issue any security updates next week in a rare break from its regular monthly Patch Tuesday update cycle.â¦