RSSFive Fixes Enroute, New IE Flaw Found
By Ed Oswald | Published April 6, 2006, 3:39 PM
Microsoft said Thursday that it plans to release five security patches as part of its monthly Patch Tuesday program next week. With this month's advanced notice, the Redmond company disclosed the nature of at least one of the fixes, a break from its normal policies.
Microsoft normally does not provide details of specific fixes to prevent hackers from taking advantage of flaws before it has a chance to address them. However, with the "CreateTextRange" vulnerability, exploit code is already available, and third parties have even gone as far to create their own patches for the flaw.
"Our test and engineering plan for that update that we began two weeks ago is on track to have that update ready for Tuesday," Microsoft's Stephen Toulouse said. "The IE team is still hard at work."
As news of the fixes broke, security firm Secunia disclosed a new active scripting flaw within Internet Explorer. According to the advisory, the vulnerability exists in how the browser loads Flash format files, and exploit code is available to take advantage of the issue.
Secunia claims that a hacker could use the flaw in order to initiate phishing attacks. A test to see if a user's browser is vulnerable was posted on the firm's Web site. No indication was given as to whether the flaw may be fixed within this month's updates.
Altogether, four patches including the "CreateTextRange" fix will be issued for Windows, with the highest severity rating of those being "critical." Another patch will address a flaw affecting Windows and Office, with a rating of "moderate."
According to eEye Digital Security, one "overdue" vulnerability has not been patched yet by Microsoft: a denial-of-service issue that exists in Windows 2000, 2003 and XP. The firm has rated this as a "medium risk" issue.
eEye rates a vulnerability as overdue after sixty days, and publicly discloses the issue in a general fashion to alert users of its presence.
In addition to the patches, Microsoft said it planned to release an update to the Malicious Software Removal Tool -- as it does each month -- and one additional high-priority non-security update via Microsoft Update.
You'd think they would have fixed this thing by now. So ask yourself: Are hackers that good, or is IE that BAD???
Score: 0
|hi ho..hi ho........it's off to patch we go.
Score: 0
|people still use IE??
Score: 0
|IE???......what is this IE that you speak of?........oh yeah, now I remember. That's the thorn in my side that I keep trying to forget.
Score: 0
|Aieeeee!
Score: 0
|I don't understand why they invest money into a free browser.
Apple had to develop its own browser because of IE. AOL was paid to use the IE engine.
they cannot make money with IE, so why not outsource it to open source? Things will not get worse.
Score: 0
|THeres so many other Web Browsers yet everyone ones afraid to switch so it in a way is thier fault if anything happens.
Score: 0
|There isn't any FEAR, there is laziness.
LUD
Score: 0
|You guys are speCULating 'n ASSuming w/o having all your s*** together:
there are still plenty of WORK-related sites & apps that only function completely with IE, not even any of its engine off-shoots will do. (btw does that word 'work' mean anything to you? Are you even of age to work, much less make such self-assured & arrogant pronouncements?
Do me a favor, fire up an old SNL rerun-- and study in detail any Emily Latella editorial, and as well Dan Akroyd's standard scold of Jane Curtin.)
Although, MS seems to be in a hurry to diminish their advantage by disabling & removing things left and right....
Score: 0
|I know about work related sites. True story: Just today I had to wrestle with IE on a banking site. The site requires activex. Activex installs on my network requires admin rights to install, (duh, else every user would have spyware,) so I must test this for the user. The site doesn't work properly with IE's pop-up blocker and PDF's, even if it's disabled, unless we add the site to the trusted sites list. This means that if this banking site ever had a trojan, I put my client PC's at risk, solely because they think it's more "secure." The activex control sends a dll down to the PC every execution... how do I know if I can trust this cr*p??
The site doesn't allow firefox. Firefox has the same basic capability, XUL, and it has a much better security record, FF is open source, FF just *works* better. Banking sites don't *need* activeX, it's complete laziness that they do that.
Even the accounting chick I was working with uses FF, she only uses IE for this site.
Yeah, I'm gonna watch Old SNL. sure I am. That'll prove your point, right? ?
Score: 0
|This is just laziness on the part of the site adminstrator. Fixing it is actually a pretty simple procedure and if they adhered to international html standards the site would work just fine in alternative broswers. That's the whole problem with IE to begin with. It has so many holes and flaws it's easy to make it work while writing crap for html code. To my mind this is the result of Microspud attempting to create a monopoly in the browser market back in the 90s and their insistance that web site admins adhere to their flawed and archaic coding system. If you want to see how bad it really is out there, download FireFox and install a little extension called "Web Developer". Visit one of your favorite web sites, then go to tools in the web developer tool bar and do any of the checks that are listed there. You'd be amazed how many errors in coding you will find.
Score: 0
|"This is just laziness on the part of the site adminstrator."
Yep. That is exactly why lazy IT people use FireFox and such--the smart(er) ones use IE and know how to secure it over a network. See my post below.
EDIT: Oh, and securing IE by using third party programs is worse than using FireFox with third-party addons. Secure IE using IE's own tools. Remember that securing IE is not= securing network. To secure a network third-party apps are a necessary evil at the present time.
My theory: Better to have compatability and capability and properly secure it, than to have less capability that requires third-pary apps and programs to work properly. Microsoft's idea is just that as well, and so is Apple's. Mozilla builds around the fact that third parties will always add the necessary functionality for their browser to work. Well--what if they don't? You decide.
Score: 0
|i feel for those who still use IE.
Score: 0
|Your sarcasm implies otherwise. Seriously, though, my company has over 350 Workstations with Internet connectivity--and we still use SP1 for XP (don't ask why, the IT guy won't tell me). Yet we have yet to have any viruses on our network or even isolated attacks from any known exploits. Why? Because we don't visit malicious websites? HE?L no--because our IT admin has half a brain and blocks malicious web domains. Any network that allows access to myspace.com, for example, does not have a good admin running it (assuming it isn't at a public library or something like that. I'm refering to University networks, hospitals, etc.)
Score: 0
|Most of these exploits are spreading through hacked IIS servers. No need to maintain a malicious web site and get yourself on a black list. When your exploit is ready just run a script, crack a respectable IIS server, insert your code, and watch the fish jump into your boat. You will always get a few hours before anyone notices.
Your company could be riddled with zombies and you wouldn't be able to tell.
The moral of this story is IE is not safe and IIS is not safe, how thrilling.
Score: 0
|Let's just assume, 1-3 IE exploits will be found, forever into the future, unless serious architectural work is done to IE. Making users users is a good start.
Score: 0
|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Take back the web, get Firefox!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Score: 0
|get Firefox, and get a different brower with unfixed vunrabilities.
Get Opera, and there are 0 unfixed security vunrabilities.
Score: 0
|Get whatever you want, so long as it isn't IE based. ;)
Score: 0
|Hooray! More updates for people to whine about! :D
Score: 0
|LOL I'm actually real sad: the way MS ham-handedly fixes IE flaws....
It's become now a daily occurrence of having to switch browser from IE at some site, so as not to miss functionalities. Never ever fathomed such an ocurrence even radomly, much less in regular fashion...
Score: 0
|