Microsoft Corp. announced today that it will issue an emergency patch tomorrow to quash a critical Internet Explorer bug that attackers have been exploiting for more than a week.The advance warning came less than a week after Microsoft acknowledged that exploit code had gone public and was being used by hackers to hijack Windows PCs running IE.
Microsoft will deliver the out-of-cycle patch Wednesday at 1 p.m. Eastern time via its normal update mechanisms, including Windows Update, Microsoft Update and Windows Server Update Services (WSUS).
The update will be pegged "critical," the most serious ranking in Microsoft's four-step scoring system. Microsoft will provide patches to users of Windows 2000, XP, Vista, Server 2003 and Server 2008 for IE5.01, IE6 and IE7. A separate patch will apparently be issued tomorrow for IE8 Beta 2, a preview version of Microsoft's next browser that is not officially on the support list.
:hugs Firefox:
*Note: The preceding comment is sarcastic for comedic effect. Reader discretion is advised.
Ohs noes
But you never when your system administrator decides to visit chinese pron sites after office hours.
Firefox being most vulnerable windows application was a 'report' but the IE exploit was a 'bug' in IE browser. That said, it never meant IE is most vulnerable or a bad browser. And Microsoft has already prepared a patch for the IE exploit.
Don't worry, they will put IE in the list when it applies the patch... I guess it will fill the required number of applied patches for the list.
I dont worry about patches unless its a Service Pack. Individual updates/fixes always work fine...at least they do for me.
MS rulez!!
NOT!!
I will DEFINITELY wait a bit before installing it anyway. With MS cranking out a patch this fast, it almost HAS to screw something else up. Could not possibly have tested it very well.
MS rulez!!
NOT!!
I will DEFINITELY wait a bit before installing it anyway. With MS cranking out a patch this fast, it almost HAS to screw something else up. Could not possibly have tested it very well.
A patch delivered through Windows update usually goes through a good amount of testing. If its just a patch on the microsoft download site, then it may or may not have gone through sufficient testing.
MS rulez!!
NOT!!
I will DEFINITELY wait a bit before installing it anyway. With MS cranking out a patch this fast, it almost HAS to screw something else up. Could not possibly have tested it very well.
Thats cool. I just hope your using firefox.
If mozilla releazed the fixes for MANY holes... does that mean that some of that holes were exposed for a prolonged time interval?
If mozilla releazed the fixes for MANY holes... does that mean that some of that holes were exposed for a prolonged time interval?
You have to realize that a lot of software has holes in it that people are unaware of. No software is 100% hole free. Why there are always update and patches for all software. So i am betting there are some undiscovered issues with windows, osx, FF, IE....you name it
csrsc.exe the executable adding a service "Windows Spooler" (an old piece of "virus code") that looks for credit card details. It makes the box unstable, Antivirus software tricked into not reporting the program, when memory resident. Obviously any malware can be used once the vulnerability has been exploited.
Why do sites like this only give the vaguest of details. The baddies know what is going on, us good guys are left in the dark. Main Stream Media has been bought and paid for, sites like this should do better.
Last edited by boho on 17 Dec 2008 - 15:10
Of course, if you're running Vista 64-bit with UAC and DEP enabled none of those exploits work...
Of course, if you're running Vista 64-bit with UAC and DEP enabled none of those exploits work...
The flaw was reported about a week ago, how could they have warned you about it 10+ days ago? And according to Symantec (source) you could have gotten that from their products' vulnerabilities as well! Don't operate a "network" if you don't know how to maintain it and keep it secure.
XP 32bit
http://www.microsoft.com/downloads/details...ylang=en&tm
XP 32bit IE7
http://www.microsoft.com/downloads/details...&DisplayLang=en
XP 64bit
http://www.microsoft.com/downloads/details...ylang=en&tm
2003 32bit
http://www.microsoft.com/downloads/details...;DisplayLang=en
2003 64 bit
http://www.microsoft.com/downloads/details...ylang=en&tm
Vista 32bit
http://www.microsoft.com/downloads/details...;DisplayLang=en
Vista 64bit
http://www.microsoft.com/downloads/details...;DisplayLang=en
Last edited by PeterUK on 18 Dec 2008 - 17:17
I got two updates, one for IE7, and another for IE8 beta 2.
Congrats to Microsoft; I hope this paves the way for rapid-response updates. Having a predictable update schedule is just another vulnerability in and of itself.
Edit:
Updated IE8 Partner Build: version 8.0.6001.18344. This build contains the fix to MSRC MS08-078.
Last edited by osm0sis on 18 Dec 2008 - 09:18
Link above posted by PeterUK has it for IE6.
What's up with that?
Installed it from the link you posted. Asked for me to restart. Did it. Don't notice a thing.
No problems at my bank site as I see the post below is inquiring about.
Cheers
Thx and Cheers
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.