Microsoft still scrambling to patch July bugs
240803
(InfoWorld) - It has become a familiar pattern: A hacker posts exploit code to a security Web site; Microsoft follows soon after with a warning to customers. The pattern was repeated again Thursday, only this time Microsoft's warning that it is investigating "new public reports" of a critical bug in Windows comes more than two months after sample code showing how to take advantage of the flaw was posted to the Web. Microsoft's advisory can beÂ found here. The flaw that Microsoft warned about is in an ActiveX control (called WebViewFolderIcon) used by the Windows' graphical user interface software. It was first disclosed on July 18 as part of aÂ month-longÂ project byÂ hacker HD MooreÂ to expose problems in browser software. Moore's blog post on the flaw can beÂ found here. Moore called his project theÂ "Month of Browser Bugs"Â and ended up disclosing a total of 22 Microsoft vulnerabilities during the period. A few days ago, Moore quietlyÂ added exploit codeÂ for this latest flaw to his Metasploit hacking tool. The exploit caught Microsoft's attention after it was posted to theÂ milw0rm.com Web site,Â Moore said. But the security researcher believes that any competent hacker could have developed an exploit based on his July blog posting. So far, Microsoft has patched only two of Moore's flaws. In fact, Microsoft engineers haven't even been able to investigate close to a third of the vulnerabilities, Moore said. Microsoft executives could not immediately be reached for comment, but the company's security advisory said this latest WebViewFolderIcon bug will be patched on Oct. 10. "We have been in contact with HD Moore and at this time our investigations have revealed that most issues relating to Internet Explorer in particular will result in the browser closing unexpectedly," Microsoft's public relations agency said Thursday in a statement. "Because of their nature, most of these issues will more likely be resolved through a service pack release rather than a security update." Microsoft has been busy this month, rushing out an emergency, "out-of-cycle" fix for a flaw in Internet Explorer's Vector Markup Language (VML) rendering engine that was being widely exploited by attackers. Microsoft has even more work ahead of it, according to Moore. In early August, he handed Microsoft another 70 bugs that he had not publicly disclosed. Still, he believes that more of his flaws should have been fixed by now. "I was kind of amused that they would do an out-of-cycle patch for the VML bug, but would let all of these lapse," he said. Microsoft has told him that at least four of his bugs are "exploitable issues," meaning that an attacker could take advantage of them to run unauthorized software on a victim's computer, Moore said. Earlier this week, SymantecÂ said that Microsoft was the slowest of the major browser-makers at patching its bugs during the first half of this year. But according to Symantec's numbers, Microsoft patched IE bugs, on average, nine days after the public disclosure of a flaw. Most of the 22 Month of Browser Bugs flaws have been in public for two months now.
300776
'Secure Development Lifecycle' only goes so far Microsoft on Tuesday issued two security updates, one of them rated critical that fixes nasty bugs in Windows Vista that could allow an attacker to gain complete control over a user's machine.â¦
688424
(InfoWorld) - Microsoft Corp. may be waiting until next month to patch a nasty bug in Outlook and Internet Explorer, but security researchers are offering users a more immediate option. A loose affiliation of security researchers going by the name of ZERT (Zeroday Emergency Response Team) has released a patch for the VML (Vector Markup Language) vulnerability, which increasingly is beingÂ exploited by criminals in malware attacks. Microsoft is scheduled to fix the bug on Oct. 10, the date it has set to release its monthly batch of security updates, but the company is under increasing pressure to release an earlier, "out-of-cycle" patch. On Friday the SANS Internet Storm CenterÂ raised its alert level from green to yellow, an indication that attacks are becoming more widespread. Microsoft has suggested a number of work-arounds to the problem, and the software vendor does not recommend that users install the ZERT patch, released Friday. "We think itâs great that there are people out there working to help protect our customers. But as we've always said, we cannot endorse third party updates," wrote Microsoft Security Response center program manager Scott Deacon in aÂ blog posting Friday. Microsoft's suggested work-around can be foundÂ here. Microsoft rigorously tests its patches to try to cut off any problems that the new software might introduce. The ZERT patch has not been widely tested and could introduce new problems when installed, security experts warn. ZERT plans to continue to release its own patches when particularly critical unpatched flaws begin to pose a "serious risk to the public, the infrastructure of the Internet or both," the group claims in a manifesto, published on itsÂ Web site . "The purpose of ZERT is not to 'crack' products, but rather to 'uncrack' them by averting security vulnerabilities in them before they can be widely exploited," the group says. ZERT sprang out of discussions on e-mail lists set up a few years ago by security researcher Gadi Evron, said ZERT member Randy Abrams, director of technical education with Eset LLC in San Diego. "Microsoft wants to assign a monthly patch and we understand that," said ZERT member Roger Thompson, who is chief technology officer with Atlanta's Exploit Prevention Labs Inc. "There's a certain benefit of staying on the monthly patch, but when things start to pop, as we think this VML thing is, there's a need to do something." The group's formation was spurred by Microsoft's WMF (Windows Metafile) vulnerability, which emerged in late 2005. Tens of thousands of Microsoft users downloaded third-party patches to fix that bug and Microsoft was eventually forced to release an out-of-cycle patch to address the problem. "This has been the first real vulnerability [since then] that the members have felt can be patched fairly quickly," Abrams said. Microsoft clearly does not want its users to get into the habit of installing third-party security patches, so if the ZERT software is widely downloaded, Microsoft may move more quickly with its own VML patch, Abrams said. "It might force Microsoft's hand on an out-of-cycle patch," he said
708266
A day after Microsoft announced it would give customers early warning of impending patches, the Redmond, Wash.-based developer fleshed out its heads-up with a notice that next Tuesday&#39;s patches
470743
Less than zero-day September's Patch Tuesday leaves users waiting for a fix to defend against a zero-day exploit in Microsoft Word, targeted by malware authors over recent days.â¦
350859
'Black Tuesday' brings four critical fixes Microsoft's June Patch Tuesday brought six security updates - four of which earn the dreaded rating of critical.â¦
50456
Although Microsoft had planned to release a patch today for a OneCare flaw that eats Outlook and Outlook Express e-mail files, user complaints prompted it to actually put out the fix on Sunday.
424439
10.3.7 fixes bugs, fills security holes
685853
Microsoft has issued fixes for more than 20 holes in its software in its February security update.
14063
Microsoft adds another product to the list of those vulnerable to a critical bug patched nearly three weeks ago.
225263
Microsoft is taking the guesswork out of Patch Tuesday by detailing the type and severity of patches in its new Advance Notification bulletins. The first of these is being used for July's Patch Tuesday.
549045
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft has offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
429232
DecemberÃ¢ÂÂs Patch Tuesday finds Vista in the bad guysÃ¢ÂÂ sights. Plus: Get Office 2007 SP1, get your fix for Flash, and avoid an HP laptop disaster.
78946
Microsoft released 11 security updates Tuesday to&#160;fix critical flaws in its products, including a publicly known ActiveX bug that affects users of the Visual FoxPro database.In total, 17 individual software flaws were patched in the updates. Microsoft rates six updates as critical, meaning they should be installed as soon as possible, while the remaining five updates are considered &quot;important.&quot; Last month was an easier month on IT administrators, when Microsoft released just two updates.Microsoft surprised some by releasing one&#160;fewer update than expected. Last Thursday, the software vendor had said that it was&#160;readying a fix&#160;for critical VBScript and JScript flaws in Windows 2000, XP, and Windows Server 2003. That update wasn&#39;t included in this week&#39;s patches, but on Tuesday, Microsoft wouldn&#39;t confirm that it had actually dropped the update because &quot;this could put customers at risk,&quot; according a spokeswoman for the company&#39;s public relations agency.Security experts said Tuesday that the MS08-010 update, which fixes four bugs in Internet Explorer, should take top priority this week. &quot;There are four vulnerabilities within that particular patch and all of them are remote-code executable,&quot; said Jonathan Bitle, director of technical account management with Qualys.&quot;The way we&#39;re looking at it, our prioritization would put MS08-010 at the top, followed by MS08-007,&quot; said Don Leatham, director of solutions and strategy with Lumension Security.MS08-010 fixes a publicly disclosed ActiveX bug that affects Visual FoxPro users. Although hackers have already posted code showing how to exploit this vulnerability, the buggy ActiveX control is not included in Internet Explorer 7&#39;s default list of controls, so the flaw should not affect most users.The MS08-007 update fixes a critical flaw in the Windows XP and Vista WebDAV redirector software. WebDAV is a Web-based document sharing protocol. The flaw is rated important for Windows Server 2003 users.Microsoft&#39;s Office products are also a major source of patches this month. Tuesday&#39;s updates include critical fixes for Microsoft Word, Office Publisher, and Office itself. There is also a critical update for Windows&#39; Object Linking and Embedding (OLE) Automation software. The remaining updates, rated important, are for Active Directory, the Vista TCP/IP stack, the Microsoft Works file converter, and two bugs in the Internet Information Services (IIS) Web server.The Patch Tuesday updates show that client-side bugs continue to be a much higher risk than server-side vulnerabilities, said Andrew Storms, director of security operations with nCircle. &quot;One would have assumed that the IIS and Active Directory vulnerabilities would have been the most serious because they stand at the core of an enterprise and provide more critical services,&quot; he said via instant message. &quot;But with this month&#39;s patches, the hacker&#39;s best bet is to take advantage of the client-side attacks.&quot;
367067
No attacks yet, but Microsoft is still urging users to apply patches.
632610
Monthly set of security patches does not include a fix for Word bug that was identified last week.
664507
(InfoWorld) - Microsoft will release five sets of security patches next Tuesday, including a critical update for users of Windows 2000,Â the company saidÂ Thursday. With the remaining four security updates rated as "important" by Microsoft, this latest round of patches appears to be less worrisome than the August updates. Last month,Â Microsoft released nine updates, six of which were rated critical. Microsoft rates its bug fixes as critical when attackers can exploit the flaws without requiring any user action. Also set to be patched this month are Visual Studio, Windows Services for Unix, SharePoint Services, and the Windows Live and MSN Messenger software. Microsoft releases its security patches on the second Tuesday of each month, generally around 11 a.m., Pacific time. With this latest rounds of patches, Microsoft will have released 55 updates in 2007, the same number it had released by September of last year.