Beware of Third-Party IE Patches
530645
The absence of an official patch from Microsoft for a known and widely exploited Internet Explorer flaw has spawned a cottage industry for homegrown fixes.
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
350003
TechWeb - The problematic fix, issued last December, affected the Firefox browser and the SeaMonkey application suite.
530951
Out-of-band Microsoft is considering plans to release an unscheduled security patch to address a serious security vulnerability in its ubiquitous Internet Explorer web browser.â¦
738749
Three more vulnerabilities in Microsoft&#39;s Internet Explorer 6.0 browser were disclosed Wednesday by Danish security vendor Secunia, bringing the total of IE bugs found by the firm in the last two months to an even dozen.
727620
A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla Corp. said it plans to patch the problem in its next Firefox software update.
221084
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) Web browser allows attackers to create a fake Web site that looks exactly like a genuine site.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
7141
(Article Central) Microsoft released its October batch of security advisories this week, with a number of &quot;critical&quot; patches, including a significant fix for the Internet Explorer browser.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
733650
(InfoWorld) - Hackers areÂ intensifying their attacks on Internet Explorer users, increasing the chances that Microsoft Corp. will patch a critical flaw in the software ahead of its regularly scheduled Oct. 10 security update. On Sunday, hackers released sample code showing how to exploit the IE flaw on a fully patched version of Windows XP, a move that security experts believe will step up the attacks.Â Criminals have been taking advantage of a previously unknown vulnerability in cPanel Inc. software, widely used by Web hosting providers, to install the IE malware on Web servers. The Microsoft bug has to do with the way IE processes Web-based graphics code written in the Vector Markup Language (VML). It wasÂ first reported Monday Sept. 18 by researchers at Sunbelt Software Inc., who found that attackers were exploiting this vulnerability on a number ofÂ pornographic Web sites. Late last week, attackers started spreading their attack code by taking advantage of a second flaw in cPanel's Web hosting administration software. This product is used by Web hosting providers to give their customers an easy way to administer their Web sites. Hackers were able to exploit this problem to gain access to servers at hosting provider HostGator.com LLC and began adding malicious VML exploit code to the Web pages of HostGator's clients, starting late Thursday. In fact, the attackers had used the cPanel flaw to gain control of HostGator's servers weeks before the VML vulnerability was disclosed, according to Brent Oxley, CEO of HostGator.com, based in Boca Raton, Florida. "They took control of as many servers as they could and they were building an army." Oxley said."They waited idly for a month and when the Microsoft exploit came out that's when they launched the attack." HostGator servers are used to host about 500,000 Web sites, but not all were compromised. Oxley estimated that "thousands" were, however, and said that a number of other hosting providers have also fallen victim to the cPanel attack. The cPanel flaw has now been patched and HostGator.com customers are no longer serving up the VML exploits, but security experts wonder how widespread the cPanel compromise has been. "It's a little worrisome that these hackers appeared to be targeting that piece of software," said Rich Miller, an analyst with Netcraft Inc. "It's very common among large hosting companies." Whether or not these latest developments are worrisome to Microsoft is unclear. The company declined to comment on the matter Monday, referring reporters to aÂ Friday blog postingÂ by Microsoft Security Response Center Operations Manager Scott Deacon in which he said that his company was increasingly confident on its ability to release an early patch.Â  "Thereâs been some confusion about that, that somehow attacks are dramatic and widespread," Deacon wrote Friday. "Weâre just not seeing that from our data, and our Microsoft Security Response Alliance partners arenât seeing that at all either," he said. "Of course, that could change at any moment," Deacon added. Sunbelt Software agreed that the VML bug has not yet been widely exploited, but Sunbelt Vice President of Research and Development Eric Sites predicted that Microsoft would release an early patch. "I think this week will be a lot more active because of the new proof-of-concept codes coming out," he said. On Monday, security researchers reported that attackers were staring to send out spam in hopes of luring victims to malicious Web sites. One attack tells victims that they've received a "Yahoo! Greeting Card," and invites them to click on a link. The link takes the victim to a Web site that installs code that collects information on the victim's online activity. More information on this attack can be foundÂ here. As a temporary workaround, Microsoft's has advised users to unregister the dll used to render VML images. Information on how to do this, along with otherÂ possible workarounds for the problem can be found here. Although it is not recommended by Microsoft, aÂ patch for the bug was released by a group of security researchers on Friday. ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
86025
An Internet Explorer vulnerability first reported yesterday is already getting a workout. Malware utilizing the hole for installation is turning up on various Russian porn sites, with more trouble expected.
106450
The &quot;highly criticial&quot; vulnerability affects Internet Explorer 5.01, 5.5, and 6 on fully patched PCs running either Windows XP SP1 or the newer SP2.
591861
A vulnerability in a Java plug-in from Sun Microsystems used by most web browsers poses a risk for users of IE and alternative browsers alike.
175699
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) web browser allows attackers to create a fake website that looks exactly like a genuine site.
737024
(InfoWorld) - Microsoft Corp. just can't seem to shake problems with itsÂ MS06-042 update for Internet Explorer. On Tuesday, Microsoft was forced toÂ release its third version of the update because of a new security bug discovered in the update, according to Tony Chor, a group program manager with Microsoft. First released on August 8, the critical patch fixes a handful of problems with the browser, but it has caused headaches for some users. Embarrassingly, it also introduced a security vulnerability into the browser, which was fixed last month. "The original release of MS06-042 introduced a new security vulnerability for IE 6.0 SP1 users which we addressed in a subsequent re-release," he wrote in aÂ Tuesday blog posting. "However... a similar vulnerability was also discovered in IE5.01 on Windows 2000, IE 6.0 SP1 (in a different location), and the original release of Windows Server 2003." Microsoft customers ran into problems with MS06-042 soon after it was released. Web sites that used HTTP (HyperText Transfer Protocol) 1.1 compression to speed up the downloading of images could cause the browser to fail and users of Web-based applications such as PeopleSoft, Siebel, and Sage CRM had problems with the software. Later in August, securityÂ researchers at eEye Digital Security Inc.Â disclosed that Microsoft had introduced a new critical security vulnerability in the update. Two days later Microsoft fixed the eEye bug in the MS06-042 re-release. Apparently this re-release did not address this latest but "similar" vulnerability mentioned by Chor. Microsoft executives could not be reached immediately for comment. Microsoft often re-issues its security updates to fix minor bugs, but the security issue discovered by eEye placed a lot more scrutiny on MS06-042. Ultimately the update proved to be an ordeal for Microsoft's Security Response Center, and for Microsoft customers.
574367
IE exploit code could boost risk of browser mishaps. Microsoft says teamwork makes for better defenses.