Researchers: IIS problems may not be Microsoft's fault
522864
Security researchers say Google may be on to something with its research on whether IIS servers are more likely to be vulnerable to malware. But there could be a plethora of reasons why that's the case.
111993
Previously satisfied users say the newest release of the software is causing a variety of problems, including an issue where the software won't load at startup. Microsoft says it is looking into at least one issue, but said overall the number of problems
235692
Microsoft's recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.
633489
OCTOBER 08, 2004 (IDG NEWS SERVICE) - Microsoft Corp. is investigating a reported vulnerability in ASP.Net that could allow an attacker to bypass security features on a Web server and view sensitive content, the company said yesterday.
708807
Blog: Researcher finds a basic cookie-handling error that could compromise Windows PCs.
451053
Activity spotted by an eWeek reporter on at least two "gray-hat" vulnerability research sites appears to indicate that an exploit for a weakness in one of Microsoft's Multimedia ActiveX controls discovered last June may still be feasible, even after four years of patches.
180369
Companies that have not patched servers against the Windows Internet Naming Service flaw need to act fast, according to a security site.
234545
A security research company is offering $20,000 for information on undisclosed security flaws in Microsoft&#39;s Windows OS.Digital Armaments, which doesn&#39;t list a phone number or a headquarters address on its Web site, is offering the money as part of the &quot;Hacker&#39;s Challenge&quot; through midnight EST, Feb. 29. The company is also soliciting for flaws in what they term &quot;Windows Diffuse Applications.&quot;Submitters need to illustrate a working exploit and document it, according to the company&#39;s Web site, which is filled with misspelled words.There&#39;s nothing illegal about paying security researchers for flaws, but it does tend to annoy software companies whose products are affected.Wabisabilabi, based in Switzerland,&#160;took the idea of compensating researchers a step further&#160;last year by opening a site for them to sell vulnerabilities in auctions. In response to criticism, company officials countered that researchers could sell zero-day vulnerabilities on the black market.Microsoft, whose security vulnerabilities are generally high profile, advocates that researchers discretely alert it to software problems so users aren&#39;t put at risk. Companies generally refuse to pay for software vulnerabilities.Digital Armaments says on its Web site its research team was founded in 2003, and offices were opened in the U.S. later that year.In addition to paying money for vulnerabilities, Digital Armaments will also apparently pay in stock or credits that can be exchanged for stock under its Digital Armaments Contribution Program.Efforts to reach Digital Armaments on Wednesday morning by e-mail were unsuccessful.
637191
Disputes over Microsoft&#39;s intellectual-property claims to its Sender ID technology are unlikely to slow the push toward developing a secure e-mail identity, according to e-mail industry representatives.
355776
Outside security researchers say Windows Service Pack 2 has security vulnerabilities, but no confirmation from Microsoft. By George V. Hulme.
122784
Businesses are more likely to pick up a virus via employee Web surfing than from e-mail attachments, according to an IDC study.
511214
InfoWorld - Web sites running Microsoft&#39;s Web server software are twice as likely to be hosting malicious code as other Web sites, according to research from Google.
420473
Although there have been no reports of major problems, some users have encountered obstacles in moving to the new Windows.
21107
Despite Window Server vulnerability recently reported, company says there's no cause for alarm.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
468760
Although Microsoft Corp. may not have the first service pack for Windows Vista ready at the end of this year as some expected, financial analysts say that a delay should not have a negative effect on enterprise adoption of the OS.
275658
It&#39;s not that there aren&#39;t Unix attacks that work. It&#39;s that pretty much everything the security industry does misrepresents the actual balance between attacks on Microsoft&#39;s products and attacks on Unix and open source.