Microsoft Probes Flaw in ASP.NET
231770
Microsoft Corp. is investigating a reported security flaw in its ASP.NET technology that could allow intruders to access password-protected sections of a Web site simply by altering a URL.
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
632318
Microsoft says it is investigating reports that a security update for the Internet Explorer browser issued last week has crippled some users' ability to get on the Web.
544632
How a seemingly simply Microsoft bug betrayed its author's disdain for a wide range of secure coding principles.
121334
Microsoft issued a patch for what it says is a &quot;critical&quot; security flaw in the way Windows programs handle JPEG images. According to a security bulletin accompanying the patch, the flaw
356486
Security flaw involving JPEG files affects at least a dozen Microsoft software applications and operating systems.
545195
Microsoft Corp. (MSFT) announced Tuesday it has found a new security flaw with its Windows XP operating system and warned that an attacker could infiltrate other computers by persuading their owners to open a specialized graphics file...
150857
Microsoft describes unpatched flaw that could corrupt PC memory and allow intruders.
124188
NOVEMBER 12, 2004  - Microsoft Corp. yesterday said it is investigating claims that several new vulnerabilities have been found in Windows XP Service Pack 2 by security firm Finjan Software Inc.
500612
Microsoft is investigating reports of a new Internet Explorer flaw that puts people with the most secure version of Windows at risk of phishing attacks.
342495
A flaw in the Microsoft programs that was announced on Sep 14, has already paved the way for a deluge of new security threats. The hackers have begun circulating malicious code hidden in images that use the popular JPEG format.
186057
Microsoft Corp. MSFT.O released on Tuesday a patch for its latest &quot;critical&quot; rated security flaw affecting its Windows, Office and developer tools software programs.
628475
Computer code that exploits a flaw in the way many Microsoft applications process JPEG images has been published on the Internet and could indicate coming attacks on vulnerable PCs, experts said.
642533
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF File that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. Microsoft actually released the patch for this flaw on Jan. 26, although it did not notify customers of this bug until Tuesday's bulletin, said Mark Griesi, a security program manager with the company's Trustworthy Computing group. Griesi said that there was no particular reason why Microsoft declined to notify customers of the update. But the fact that this was Microsoft's first security product patch since implementing its monthly system apparently contributed to the decision. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he said. "This time we decided to wait. We won't do it again." In total, six of Microsoft's 12 updates are rated as "critical," the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft Word , which fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. The updates fix 20 bugs in total, including all four of the Word flaws that hackers had been exploiting, Griesi said. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
279266
A week after releasing Windows XP Service Pack 2 to enterprises, Microsoft is trying to quell confusion over an apparent security flaw and applications that won&#39;t work without adjustments.
298750
A critical flaw in Microsoft&#39;s Internet Explorer Web browser could allow a hacker to take control of a computer, the world&#39;s largest software maker said Wednesday.
362606
Microsoft issued a patch for a vulnerability in its server software that could allow an attacker to spoof trusted Internet content.