Drag-and-drop flaw mars Microsoft's latest update
448507
An independent researcher finds an Internet Explorer vulnerability that could turn drag-and-drop into drag-and-infect.
414849
The giant has released a patch so that Windows doesn&#39;t let in hackers when it handles JPEG graphics formats. The flaw means that attackers can create an image file that will automatically run dodgy code, dump
321788
Microsoft on Tuesday issued a patch for an earlier discovered flaw in Visual Studio 2005, while yet another cumulative patch for Internet Explorer was released, as well as one for a vulnerability within the Windows Media Format.
737024
(InfoWorld) - Microsoft Corp. just can't seem to shake problems with itsÂ MS06-042 update for Internet Explorer. On Tuesday, Microsoft was forced toÂ release its third version of the update because of a new security bug discovered in the update, according to Tony Chor, a group program manager with Microsoft. First released on August 8, the critical patch fixes a handful of problems with the browser, but it has caused headaches for some users. Embarrassingly, it also introduced a security vulnerability into the browser, which was fixed last month. "The original release of MS06-042 introduced a new security vulnerability for IE 6.0 SP1 users which we addressed in a subsequent re-release," he wrote in aÂ Tuesday blog posting. "However... a similar vulnerability was also discovered in IE5.01 on Windows 2000, IE 6.0 SP1 (in a different location), and the original release of Windows Server 2003." Microsoft customers ran into problems with MS06-042 soon after it was released. Web sites that used HTTP (HyperText Transfer Protocol) 1.1 compression to speed up the downloading of images could cause the browser to fail and users of Web-based applications such as PeopleSoft, Siebel, and Sage CRM had problems with the software. Later in August, securityÂ researchers at eEye Digital Security Inc.Â disclosed that Microsoft had introduced a new critical security vulnerability in the update. Two days later Microsoft fixed the eEye bug in the MS06-042 re-release. Apparently this re-release did not address this latest but "similar" vulnerability mentioned by Chor. Microsoft executives could not be reached immediately for comment. Microsoft often re-issues its security updates to fix minor bugs, but the security issue discovered by eEye placed a lot more scrutiny on MS06-042. Ultimately the update proved to be an ordeal for Microsoft's Security Response Center, and for Microsoft customers.
78946
Microsoft released 11 security updates Tuesday to&#160;fix critical flaws in its products, including a publicly known ActiveX bug that affects users of the Visual FoxPro database.In total, 17 individual software flaws were patched in the updates. Microsoft rates six updates as critical, meaning they should be installed as soon as possible, while the remaining five updates are considered &quot;important.&quot; Last month was an easier month on IT administrators, when Microsoft released just two updates.Microsoft surprised some by releasing one&#160;fewer update than expected. Last Thursday, the software vendor had said that it was&#160;readying a fix&#160;for critical VBScript and JScript flaws in Windows 2000, XP, and Windows Server 2003. That update wasn&#39;t included in this week&#39;s patches, but on Tuesday, Microsoft wouldn&#39;t confirm that it had actually dropped the update because &quot;this could put customers at risk,&quot; according a spokeswoman for the company&#39;s public relations agency.Security experts said Tuesday that the MS08-010 update, which fixes four bugs in Internet Explorer, should take top priority this week. &quot;There are four vulnerabilities within that particular patch and all of them are remote-code executable,&quot; said Jonathan Bitle, director of technical account management with Qualys.&quot;The way we&#39;re looking at it, our prioritization would put MS08-010 at the top, followed by MS08-007,&quot; said Don Leatham, director of solutions and strategy with Lumension Security.MS08-010 fixes a publicly disclosed ActiveX bug that affects Visual FoxPro users. Although hackers have already posted code showing how to exploit this vulnerability, the buggy ActiveX control is not included in Internet Explorer 7&#39;s default list of controls, so the flaw should not affect most users.The MS08-007 update fixes a critical flaw in the Windows XP and Vista WebDAV redirector software. WebDAV is a Web-based document sharing protocol. The flaw is rated important for Windows Server 2003 users.Microsoft&#39;s Office products are also a major source of patches this month. Tuesday&#39;s updates include critical fixes for Microsoft Word, Office Publisher, and Office itself. There is also a critical update for Windows&#39; Object Linking and Embedding (OLE) Automation software. The remaining updates, rated important, are for Active Directory, the Vista TCP/IP stack, the Microsoft Works file converter, and two bugs in the Internet Information Services (IIS) Web server.The Patch Tuesday updates show that client-side bugs continue to be a much higher risk than server-side vulnerabilities, said Andrew Storms, director of security operations with nCircle. &quot;One would have assumed that the IIS and Active Directory vulnerabilities would have been the most serious because they stand at the core of an enterprise and provide more critical services,&quot; he said via instant message. &quot;But with this month&#39;s patches, the hacker&#39;s best bet is to take advantage of the client-side attacks.&quot;
708807
Blog: Researcher finds a basic cookie-handling error that could compromise Windows PCs.
695012
"Limited attacks" are exploiting a previously unknown security bug in Microsoft Word, Microsoft warns.
715397
(InfoWorld) - Microsoft Corp. has released its monthly set of security patches, fixing a critical flaw in Office. Attackers could exploit the bug by tricking Office users into opening a maliciously encoded .pub document, which would then allow attackers to run unauthorized software on a victim's PC. These .pub documents are created by Microsoft's Publisher software, an Office component used for designing print and online business publications. The flaw isÂ described here. Microsoft rates the bug as critical for Publisher 2000, but this warning has been downgraded to "important" for the Publisher 2002 and Publisher 2003 products. Some security experts expected Microsoft toÂ fix a similar bug in Word, which has been used by online attackers over the past few weeks, but that problem remains unfixed. Microsoft acknowledged the Word problem last week and probably did not have time to run a fix through its quality assurance tests, said Jonathan Bitle, a manager of technical accounts with Qualys Inc. "It's really late in their engineering cycle, so it's understandable that they wouldn't manage to get something out," he said. Both the Word and Publisher bugs rely on the same type of attack to work: an attacker e-mails a malicious document and somehow tricks the victim into clicking on the attachment. Security experts have been seeing more of these Office flaws exploited of late. "This is one of the trends that we have observed," said Amol Sarwate, director of the Qualys vulnerability research lab. "The growing number of client-side vulnerabilities where you have a malformed Publisher file or Word file or Excel file." Tuesday's patches also include less-critical fixes for two Windows components: the PGM (Pragmatic General Multicast) protocol used by Microsoft's Reliable Multicast Program software to transfer data, and the Windows Indexing service, which is used by the operating system's search engine. Microsoft's security bulletins offer more information. September may seem likeÂ a bit of a reprieve for harried system administrators who were given 19 updates to test and deploy over the past two months. Microsoft was forced toÂ reissue one of its August patches after it caused Internet Explorer to crash when working with a Web-based enterprise applications such as PeopleSoft and Siebel. But before Microsoft patchers get too relaxed, they should brace for the possibility of another patch later this month, Qualys said. Because attackers are actively exploiting the Word problem, Sarwate believes that Microsoft may issue an "out-of-cycle" patch for the problem, ahead of its next scheduled security updates, which are due Oct. 10. Â
217347
Stop us if you've heard this before Security experts warn a new, unpatched vulnerability in Internet Explorer might be used to spread malware. A flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control, rated as critical by Secunia and other security watchers, has spawned proof of concept code but has not yet become the subject of widespread, hostile attack. Memory corruption is possible even on a fully patched Windows XP system.â¦
524507
A variant of a bug that uses an Internet Explorer 6 vulnerability exposes Microsoft Windows systems patched with Service Pack 2. A security researcher claims to have crafted a simpler version of a bug first identified in late October.
722122
Security experts are reporting several new Windows and Internet Explorer vulnerabilities at year-end, including a flaw in the way Windows handles image files, and another involving IE and SP2 help files.
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
124001
Firefox and Internet Explorer 7 do not properly handle JavaScript "onUnload" events and can be tricked into taking a user to the wrong URL, according to security researcher Michal Zalewski.
705445
A bug that affects the OLE32.DLL library in Windows XP and 2000 could crash the operating system and cause users to lose unsaved data. Microsoft said it is looking into the matter.
155594
Security researchers inspecting a new update to Microsoft Corp.'s Windows XP found two software flaws that could allow virus writers and malicious hackers to sidestep new security features in the operating system.
421758
A security bug in Microsoft Internet Explorer&#39;s drag-and-drop feature could put millions of Web surfers at risk of malicious hacker attacks, researchers warned on Thursday.
201525
TechWeb - The glitch occurred when Microsoft updated the Windows Desktop Search tool for Windows XP SP2 and Windows Server 2003 SP 1+.