RSSTiny Patch Tuesday Brings Two Fixes
By Ed Oswald | Published November 13, 2007, 4:22 PM
Compared with previous Patch Tuesdays, November's version was quite small with Microsoft releasing only two patches for the Windows operating system: one rated critical and the other important.
The critical patch addresses an issue with how the Windows shell handles URIs. A specially crafted URI could allow an attacker to execute arbitrary code due to an error in the way it is validated.
Currently the issue has only been identified to be exploitable through Internet Explorer 7. However, the actual flaw itself is in a shell DLL, which can be found in Windows XP and Server 2003.
Security firm Qualys noted that several patches that address a similar issue within other applications shows that this is likely not limited to IE7. The company also identified Mozilla and Adobe products as being potentially vulnerable.
"Having said that, application vendors will benefit from Microsoft's operating system ability to sanitize at the shell level," Qualys lab chief Amol Sarwate told BetaNews.
The second patch repairs an 'important' flaw in how Windows handles DNS. A spoofing vulnerability exists where a specially crafted response to a DNS request could redirect legitimate traffic to sites with less than legit purposes, Microsoft said in an advisory.
In order to fix the problem, Microsoft said it increased the randomness of DNS transaction IDs. Sarwate said that DNS administrators should treat the issue as critical however. The problem affects both Windows Server 2000 and 2003.
"In summary, despite what appears to be a relatively small release, the impact to unpatched systems is significant to both end users and server administrators," he said.
Wasn't Vista supposed to be more secure? So much for those billions.
Score: 0
|Am I going mad here, or were there no fixes for Vista this time around?
Score: 0
|Your not going mad, another example of a troll kicking off about Vista without reading the article.
Score: 0
|Hey, 'Professor'... this article was not about Vista.
Score: 0
|*poke*
Score: 0
|so much for this:
"The first update addresses several reliability and stability issues. Battery life will be improved, as well as making wireless connections more stable. The recovery time after coming out of sleep has also been shortened."
http://www.betanews.com/...es_This_Week/1194882785
Score: 0
|Sweet, I think I'm going to recomend we roll out IE7 at work now... 'bout time that patch was released.
Score: 0
|Obligatory:
[Vehement rebuttal to your claims that 'my OS' is full of holes]
followed by
[Vehement approval of such-and-such operating system which is full of holes]
followed by
[Vehement argument that even though both operating systems are full of holes, 'mine' is better because I said so]
followed by
[list of reasons your OS 'sucks', with additional denial of reasons my OS 'sucks']
starring
[Use of M$ to refer to microsoft, calling anyone who disagrees with me a 'linsux/mac fanboi', nonsensical arguments in rebuttal to your equally nonsensical arguments, vehement denial in rebuttal to your equally vehement denial]
Additionally starring
[etc.]
Score: 0
|You forgot linsux
Score: 0
|Someone has way too much time on their hands...
Score: 0
|Very accurate portrayal of OS fanboy 'debates', I must say.
By the way...
I like Windows better, and no one can prove otherwise. :)
Score: 0
|Great summary. OS fights are the epitome of boring interaction.
People should just use what they use and shut it.
Score: 0
|You lying sack of poo! You hate Windows, you said so last week! :P Dang moderators must have removed the original post, lol.
Score: 0
|Too close to home? ;)
I think he pretty much nailed it.
BTW; QNX is the shiznit, dogg.
Score: 0
|Okay, okay... fine! I admit it! I still use my Commodore 64 for everything... and I love it! At least with text web browsing I don't have to deal with ads. :)
Score: 0
|smells like....mmmmmmmmm...swiss cheese
Score: 0
|You should probably see a doctor about that. ;)
Score: 0
|I feel... incomplete.
Score: 0
|