Unofficial IE patch saves humanity
83412
Third party, fire and theft Security researchers have released a patch designed to protect users against an outstanding Internet Explorer vulnerability in the absence of available security updates from Microsoft.â¦
733412
(InfoWorld) - Mozilla late yesterday patched Firefox to fix nine bugs, including the controversial critical vulnerability that involved both the open source Web browser and Microsoft's Internet Explorer. Firefox 2.0.0.5, which can be downloaded in versions for Windows, Mac OS X, and Linux in 42 localized editions, fixes the "firefoxurl://" vulnerability that can be exploited only on systems where Firefox is installed but IE is the primary browser. For the past week, researchers have quarreled over whether Mozilla or Microsoft was responsible for the flaw and which company should patch its software. In the security advisory, one of eight issued yesterday that outline the nine bugs, Mozilla again refrained from expressly putting the onus on Microsoft. But as before, it came close. "Other Windows applications can be called in this way and also manipulated to execute malicious code," read the advisory. "This fix only prevents Firefox and Thunderbird from accepting bad data. This patch does not fix the vulnerability in Internet Explorer." And more blunt was the single suggested work-around. "Mozilla highly recommends using Firefox to browse the Web to prevent attackers from exploiting this problem in Internet Explorer," it said. One of the researchers who last week pinned blame on Microsoft had not changed his tune as of yesterday. "This [Firefox patch] does not actually fix the flaw in Internet Explorer, but simply patches one of the myriads of attack vectors," said Thor Larholm, a Danish researcher who publicized the exploit. "I can definitely understand the initial reaction from Microsoft. Most of the emphasis in the public vulnerability reports were dealing with Firefox, the '-chrome' command-line argument, and how to properly escape the exploit code. "However, I can still automatically launch a wide range of external applications from Internet Explorer and provide them with arbitrary command-line arguments, [including] AcroRd32.exe (Adobe Acrobat PDF Reader), aim.exe (AOL Instant Messenger), Outlook.exe, msimn.exe (Outlook Express), netmeeting.exe, HelpCtr.exe (Windows Help Center), mirc.exe, Skype.exe, wab.exe (Windows Address Book), and wmplayer.exe (Windows Media Player), just to name a few," Larholm wrote. Microsoft's position last week has been that IE is not buggy and so wouldn't be patched. "Microsoft has thoroughly investigated the claim of a vulnerability in Internet Explorer and found that this is not a vulnerability in a Microsoft product," a spokesman said last Thursday. Other patches put into place by 2.0.0.5 included multiple memory corruption bugs. "With enough effort ... some of these could be exploited to run arbitrary code," a cross-site scripting vulnerability and a flaw that could give attackers access to the browser's cache. Mozilla picked up the pace to push Firefox 2.0.0.5 out to users earlier than scheduled. On Monday, Mozilla developers pegged the update as a "fire drill release" because of the critical nature of the firefoxurl:// bug. At the time, July 19 was the target for 2.0.0.5's release. "But we might be able to accelerate the release," notes from a weekly status meeting read. This is the first update to Firefox since support for the older 1.5.x line was discontinued. Earlier this month, users of that version were offered an automatic update to Firefox 2.0.0.4.
691915
And a further five 'important' patches Microsoft released eleven patches yesterday, with six of them meriting a critical rating.â¦
634523
Microsoft's upcoming Internet Explorer 8 browser has passed a widely-used Web standards test, news that was released after complaints from developers about a lack of information about its support for standards.
420080
An update to Firefox fixes a number of security flaws in the browser.
659695
Microsoft has acknowledged that a bug fix for its Internet Explorer browser last week did, indeed, cripple the browser for some users. Rather than re-release the patch, it's telling users how to modify Windows' registry to get IE back up and running.
599385
Opinion: Internet Explorer is insecure junk, and it&#39;s time for Windows users to move to Firefox if they want to protect their systems.
57594
The new patches apply to a variety of products, including some versions of Microsoft&#39;s Windows operating system and server software, its Internet Explorer Web browser and Excel spreadsheet program.
648687
Microsoft rushed out a patch to fix a hole in its IE browser software that was being widely exploited.
250610
Blog: Critical patches include those for Internet Explorer, Outlook Express and Windows Mail,  Win 32 API, and the Schannel Security Package.
414848
That should have been said a long time ago. After Microsoft cemented a monopoly of the Web-browser market, it let Internet Explorer go stale, parceling out ho-hum updates that neglected vulnerabilities
478094
Security firm Secunia has detailed a new flaw in Internet Explorer that affects users running Windows XP Service Pack 2. The vulnerability involves drag-and-drop, which can be used within a Web page to place a malicious program in the Windows startup folder.
2243
(InfoWorld) - With attackers finding new ways to exploit aÂ critical flaw in Internet Explorer, Microsoft Corp. has released a patch for the problem, ahead of its next scheduled round of security updates. The patch fixes a critical vulnerability in the way Internet Explorer renders VML (Vector Markup Language) graphics. Hackers had been exploiting the flaw, which also affectsÂ some versions of Outlook, for more than a week, and in recent days malicious activity had been on the upswing. More information on the update, which was released Tuesday, can be foundÂ here. The out-of-cycle release is unusual, but not unprecedented. Microsoft generally releases its security updates on the second Tuesday of every month, giving system administrators a predictable way to set aside time to test the new software. Occasionally, the company will release patches ahead of time if a flaw is being widely exploited by attackers. In January itÂ patched a critical flaw in the Microsoft Windows Metafile (WMF) image-rendering engine after it became a widespread problem. With attack code that works on the latest version of Windows XP now publicly available, the VML bug is shaping up as a very serious concern for administrators, said Ken Dunham, the director of Verisign Inc.'s iDefense Rapid Response Team. VML attacks have now "dwarfed the WMF activity in the same period of time compared to last year," he said. By Tuesday, more than 3,000 Web sites were already infecting users with malware that exploited the VML bug, according to Dunham. One week into the WMF outbreak last January, iDefense saw about 600 sites exploiting the problem. Security experts also warn that there are many variants of the VML malware, some of which may be missed by security software. Researchers at iDefense are now looking at a dozen possible variations of the VML exploit code and have confirmed the existence of seven variants, Dunham said. "With WMF there wasn't nearly as much modification. We see a lot of different permutations and obfuscation techniques being utilize with VML attacks." AÂ group of security researchers released a patch for the VML flaw late last week, independent of Microsoft, but criminals have even found a way to exploit the fix. In the past few days they have been circulating phoney e-mails, claiming to be a patch for the VML problem. If downloaded, this fake patch actually installs malicious software on the victim's system, Dunham said. Microsoft's next regularly scheduled security updates will be released Oct. 10. Â ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
435582
Blog: Updates address some critical vulnerabilities in the popular browser.
556996
A patch has been issued for the JpegOfDeath hole. But so what? No one believes every single user of Microsoft&#39;s Internet Explorer is going to apply it, and this means the door is wide open for hackers.
429232
DecemberÃ¢ÂÂs Patch Tuesday finds Vista in the bad guysÃ¢ÂÂ sights. Plus: Get Office 2007 SP1, get your fix for Flash, and avoid an HP laptop disaster.
543022
Code that exploits a serious, yet-to-be-patched hole in Microsoft's Web browser has been posted on the Net.