Browser Blame Game Wages Over Windows Flaw
525115
Mozilla will patch Firefox but Microsoft won't update IE--and each points fingers for the problem.
740269
(InfoWorld) - Users are being advised to disable a certain type of file in Microsoft's Windows Media Player software following the discovery of a new security hole in the software. The flaw, which affects Windows Media Player versions 9 and 10, could allow a malicious hacker to run unauthorized software on a victim's PC or cause a denial of service attack, according to security company FrSIRT, which rated the problem critical in an advisory Thursday. The flaw is due to a buffer overflow error that can occur when Windows Media Player is used to run ".asx" media files, according to a warning from eEye Digital Security . Such files open automatically in a Web browser, meaning a hacker would need only to post an infected .asx file in a Web page and then try to lure users to visit the page, eEye Digital said. An infected file could also be sent via email, in which case users would need to be persuaded to open it. Microsoft said an initial investigation revealed that the "proof of concept" code could allow an attacker to execute code on a user's machine. It said it was unaware of any attempts to exploit the vulnerability, and it was unclear Friday morning if the proof of concept code it referred to was in the hands of hackers. Users can protect against the vulnerability in Internet Explorer by preventing it from opening .asx files automatically. Turning off Active Scripting would also greatly reduce, but not eliminate, the risk, Microsoft said. FrSIRT also recommended that users upgrade to Windows Media Player 11 , which it said is not affected. Microsoft was still determining Friday whether it needed to issue an "out of cycle" security fix for the problem or patch it with its next monthly software update. The flaw was originally reported on Nov. 22, when it was identified only as a denial-of-service issue. Some discussion boards described the problem as a "zero-day exploit," although it was unclear if that was the case. Zero-day exploits occur when exploit code is released on the same day that a flaw is uncovered, giving users no time to protect themselves. It's been another busy week for Microsoft's security teams. On TuesdayÂ the company warnedÂ of an unpatched vulnerability in Word that had been the subject of what it called "limited attacks." And on Thursday it said it was readying several patches for Visual Studio and Windows that it plans to release next week. The patches currently due for next weekÂ do not address the problemsÂ with Word and Windows Media Player.
632521
Better install Microsoft's latest patches--hackers have posted attack code to exploit the flaws in Works.
661124
Microsoft said Tuesday that the glitch that caused Windows Genuine Advantage servers to fail this past weekend was due to human error.
47409
Mozilla works to fix a Firefox browser flaw that could give attackers unauthorized access to data on a victim's PC.
143929
Microsoft Windows users need to watch out for several flaws in non-Microsoft media players.
530645
The absence of an official patch from Microsoft for a known and widely exploited Internet Explorer flaw has spawned a cottage industry for homegrown fixes.
414849
The giant has released a patch so that Windows doesn&#39;t let in hackers when it handles JPEG graphics formats. The flaw means that attackers can create an image file that will automatically run dodgy code, dump
480779
Malware arrives in the form of a game, disables antivirus protection.
189807
Browser flaw may leave you vulnerable to phishing attacks.
221404
Millions of computer users are at risk of attack because flaws in the way Windows handles some images.
312110
AS WE PREDICTED last week after a weekend free time, hackers have come up with a method of exploiting the latest hole in Microsoft Windows.
2920
A Firefox 'flaw' revealed at a hacker conference over the weekend was a joke, hacker admits.
95664
A attack on Windows machines that uses Internet Explorer and a vulnerability in a RealPlayer ActiveX control is spreading in the wild, and researchers say the situation is urgent.
478094
Security firm Secunia has detailed a new flaw in Internet Explorer that affects users running Windows XP Service Pack 2. The vulnerability involves drag-and-drop, which can be used within a Web page to place a malicious program in the Windows startup folder.
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
149856
InfoWorld - Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.