'Critical' Windows fix rushed out

Advertisement (Why?)

As expected, Microsoft has issued a patch two weeks early to plug a security hole that has been exploited by cybercriminals

Microsoft issued a "critical" security fix for Windows on Tuesday, two weeks before its scheduled release date.

The company is breaking with its monthly patch cycle to fix a flaw that cybercrooks have been using to attack Windows PCs via Internet Explorer. Malicious software can be loaded, without the user's knowledge, onto a vulnerable Windows PC when the user clicks on a malicious link on a Web site or in an email message.

"An attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML email that could potentially allow remote code execution if a user visited the Web page or viewed the message," Microsoft said in security bulletin MS06-055. Email messages that use HTML, or HyperText Markup Language, look like a Web page.

The vulnerability does not apply to IE 7, the upcoming version of IE that is available right now in a pre-release form, Microsoft said.

Microsoft typically releases fixes on each second Tuesday of the month, which has become known as Patch Tuesday. The last time the software maker rushed out a fix was in January, when another image-related flaw in IE was being used to compromise Windows PCs through malicious Web sites.

View: Full Article @ ZDNet

#1 timbo3 on 27 Sep 2006 - 15:36

Cybercriminals and Cybercrooks, eh?

Where's the Cybermuggers and cybertheifs?

(1 reply) #2 Cryton on 27 Sep 2006 - 15:53

/me cyberslaps timbo3 through an unsecure window and then escapes down the information superhighway

#2.1 guylaroche on 27 Sep 2006 - 22:10

LOL

(1 reply) #3 ir0nw0lf on 27 Sep 2006 - 15:56

Nice to see that Microsoft is still willing to break the Patch Tuesday cycle to issue patches of "universal importance." (I'm sure that's how Microsoft sees it)

BTW, all the "cybertheifs" are off running their cyberspellcheckers so they can be properly labeled "cyberthieves."

#3.1 AMDMEFX-55 on 27 Sep 2006 - 16:01

lol

(4 replies) #4 Buttus on 27 Sep 2006 - 16:04

Microsoft + rushed + fix = doesn't sound very good

#4.1 Tz on 27 Sep 2006 - 16:38

Why not? Are you saying it would have been better to wait a fortnight? Because, by the sounds of it, it's a pretty serious flaw in IE, so I'm not sure how releasing it at a later date would do any good whatsoever. I'm sure if there were any problems someone would have reported it by now.

#4.2 markjensen on 27 Sep 2006 - 17:00

Microsoft + ready fix + delay = not good
Microsoft + ready fix + now = good

#4.3 xploit1030 on 27 Sep 2006 - 17:01

I think Buttus is speaking more to the verbage "rushed" than anything else. I don't believe this was "rushed" through their testing, they just opted not to wait until October to release it.

#4.4 Buttus on 27 Sep 2006 - 18:11

Quote - xploit1030 said @ #4.3

exactly, how many times have they had to patch the patches when they didn't rush?

#5 shirike on 27 Sep 2006 - 17:23

I don't see any log in my Event Viewer for this patch being installed. I did, however, receive a strange message when trying to reboot my machine today (I left it running all day to download a torrent) and it just hung on rebooting stating

"Installing update (1 of 1).."

then

"Please do not reboot and turn off your PC; machine will be restarted automatically"

(Or something along those lines).

I had to press the reset button to get it to reboot.

Again, nothing was recorded on Event Viewer.

Edit: Because I'm using Ie7 beta - d'oh!

Last edited by shirike on 27 Sep 2006 - 17:31

(1 reply) #6 JJ_ on 27 Sep 2006 - 18:32

Old news. This article wasnt rushed out was it

#6.1 markjensen on 27 Sep 2006 - 18:55

Oh noes!!111eleven

The patch was released Tuesday, and the news posted Wednesday. That's, like, ummm..., the next day or something.

"Old news", indeed!

(3 replies) #7 ALUOp on 27 Sep 2006 - 19:24

I don't understand why M$ has to post most critical security updates on the second Tuesday of the month.
Just to get a headline when it push the patch out earlier?

#7.1 jarek91 on 27 Sep 2006 - 19:37

Umm...have you thought about corporations and how they like to be able to plan outages and reboots? It's a lot easier to just plan to roll out new patches on the same day every month rather than the random buckshot pattern it used to be. Yes, you have the downside of some vulnerabilities being announced and not patched for a few weeks sometimes even though the patch is ready...but the stable schedule tends to make the PHBs happy.

#7.2 markjensen on 27 Sep 2006 - 20:03

But those PHBs could have very well set up a monthly internal PC update schedule (or every other week, or twice quarterly, etc.) to give themselves a "regular" update schedule. Many organizations already did.

The excuse of "stable schedule" does not hold water. It was as stable as they wanted it before. Now it is a matter of waiting.

#7.3 cork1958 on 28 Sep 2006 - 10:11

Quote - jarek91 said @ #7.1

Yeah, and we all know how stupid most corporations are when it comes to planning and actually doing it! What difference does it make whatsoever, what day the patches are rolled out. They come out Tuesday, some corporation decides that Thursdays are their updates, and poof, it's done on Thursday. Not to tough! That excuse is about as lame as it can get!

#8 theblazingangel on 27 Sep 2006 - 21:18

Emergency AutoPatcher KB925486 Update releases available here

(1 reply) #9 Croquant on 27 Sep 2006 - 21:37

So, it's a phishing patch for IE6, really.
Meanwhile, Firefox 2.0 hit RC1 today.
Coincidence?

#9.1 Kushan on 27 Sep 2006 - 22:41

Yes.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net