Slashdot Mirror
Uber-patch for Internet Explorer
malevolence writes: "According to The Register, Microsoft has released an Uber-Patch for Internet Explorer that fixes all known security problems, as well as 3 new ones, including the content-type issue that was reported on slashdot a few days ago."
What does the "uber patch" do, install Mozilla?
Boy, Microsoft sucks. This patch doesn't even address future, yet-to-be-discovered vulnerabilities.
--
Mod up a post Rob doesn't like and you'll never mod again
Just when I thought that I knew the difference between a Service Pack, Security Rollup Patch and a cumulative Hot Fix they go and release a Security Bulletin like this one.
BOSTON SUCKS!
For those of us with less than a few hundred MS clients (read: fewer clients that would make usefull something as heinous as SMS push upgrades) the issues are still very clear:
1). It takes too much time to keep up on MS software patches.
AND
2). Once you know what you need you still have to go box to box to box to patch (in *most* cases).
Granted the 'uber-patch' will help, but it still means I need a couple more inters to walk from machine to machine and interrupt users. IMO, patch managment tools should be MS's #2 priority (right behind 'getting it right the first time').
Cheers,
-- RLJ
This does not appear to be a service pack, and the target builds listed for the hotfix are only IE 5.5 SP2 and 6, so you'll need to head here to get yer SP and then install the hotfix (get directly to it from here).
It seems unlikely that the SP2 for 5.5 includes this as of right now, although it will eventually (I know sometimes I'll download an SP and take a few days to actually install it). Check your versions before you plunge your box into browser hell =)
Here's the direct download URLs, so you don't have to wade through MS's crufty site:
c 23/6/W98NT42KMeXP/EN-US/q313675.exe c pac23/5.5_SP2/WIN98Me/EN-US/q313675.exe
for IE6:
http://download.microsoft.com/download/IE60/secpa
for IE5.5:
http://download.microsoft.com/download/ie55sp2/se
These updates have not yet appeared on Windows Update.
I had two users today get the Nimda.E variant via email. It had an interesting header that was included from an html formated email's iframe . . .
I'll leave out the actual format of the email's html. But what happened was Windows tried to run sample.exe right after previewing. No popup box, no nothing. And this was using Outlook Express 5.0 It was a good thing that the virus software saw the executable as a Nimda. If they had sent a format.exe that would have been it for the two user's data.
Microsoft said that only 6.0 was affected?
Or is this something different than what they have supposedly patched?
What if it was the reverse. The DOJ gives MS leniency, but calls in a favor with the FBI to announce some "Magic Lantern" spyware, and suddenly open projects become very popular....
...naw. ;-)
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
I have to agree about the anti-microsoft atmosphere here. Not only with this statement but all the "It deletes IE!" "It installs Mozilla!" jokes just make you people look like you are desperate to fit in. Its pathetic!
IE is the best browser out there. Check ANY review. And MS has jumped to fix a bug that everyone found (notice the GAPING HOLE in Solaris/AIX systems that still isn't patched? Why aren't you going off on that?)
Remember when you had to purchase Netscape, but IE was free?
Mozilla MAY -become- better, but it isn't, yet. If you give me that "IE doesn't run in Linux" then why are you even posting to this article?
You guys need to be less Open Source/Anti-Microsoft Zealotous.
I'd post anonymously to preserve karma, but the authors already know my IP (see sig).
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
Reminds me of a pair of pants my neighbor had. So many patches there wasn't any original fabric left.
Give me my freedom, and I'll take care of my own security, thank you.
It's also important to note that it's not just users of IE as their browser that are affected by this bug. Lots of Windows programs took a shortcut (Eudora being a prime example) and used MSHTML.DLL as the rendering engine for their application. Any application that displays HTML and uses MSHTML.DLL and has IE5.5 or IE6 should install this patch IMMEDIATELY.
Some people take their .sig way too seriously
Michael exaggerated this exploit beyond belief:
If Microsoft suddenly changes how their browser handles downloaded files, tens of thousands (perhaps hundreds of thousands? any webpage which downloads files) of webpages "designed for IE" will have to be rewritten.
Good grief! Can somebody link to the tens of thousands of "designed for IE" webpages that are currently incompatible as a result of this patch?
In fact a proper "fix" of this hole probably involves de-integrating their browser and local file handling to some extent.
Eerrr.. a proper "fix" of Michael's previous article probably involves a higher level of computer literacy, and less impulsive urge to write expository essays that sound dramatic, but are wrong.
The update only works with IE 5.5 or 6.0. You might be running 5.0.
Interesting note: If you read the bulletin and click on the Technical Details submenu, you'll find the worst part:
As someone who does some sysadmin stuff at work, I didn't know this before. This means that a large majority of users (as far as my limited experience goes) that still use IE 5.0 will still have exploit available that won't be tested nor fixed. Wow...
Microsoft is like a condom. It'll protect you, but if you use it, you're screwed.
Give me my freedom, and I'll take care of my own security, thank you.
Well, it's certainly a good thing that there are so many people looking at the source to produce a patch...
er....
Never mind.
--saint
Yesterday you bashed MS for not going public about anything, and now you bash them for patching the program. Short of open sourcing everything, is there anything they could do that would appease this croud?
They might not get it right on the first try, but they do fix their bugs, and i think this was fairly timely, especially given the size / scope of IE.
for IE5.5 for IE5.5:s ec pac23/5.5_SP2/WIN98Me/EN-US/q313675.exe
http://download.microsoft.com/download/ie55sp2/
Note, that is for IE 5.5 SP2 if you have SP1, or plain vanilla 5.5, you will first have to upgrade, so you may want to wait till a full release with the patches is available. SP2 is 17MB download.
Anyone know what the equivalent version is if you have the AOL version of IE? (not that I do) but you can imagine AOL will be slowed to a crawl if every single user must get an upgrade first to SP2 or IE6, then get this patch. When - oh - when will AOL finally become browser neutral or go entirely to Netscape/Mozilla?
Work for Change & GET PAID!
Warning: mild flamebait.
Remember Michael's over-the-top misinformed rant about this 3 days ago?
I'm surprised he posted this fix, kinda points out how far off base /. was
a short 3 days ago. Hey, I'm no M$ fan and I kinda expect some opinion on /.
posts ... but there comes a point when it turns into yellow journalism and becomes childish M$ name calling.
Now Microsoft will get Slahdotted. One more reason for them to hate us. *sigh*
There are 01 kinds of cars in the world. The General Lee, and everything else.
Care to back this up? Have you used the alternatives? In case you missed it, here is what Moz has that is lacking in IE:
Those are just some of the highlights of why mozilla is the better browser and quite frankly, blows away IE, even as prerelease software
Comment removed based on user account deletion
*sigh* It's Friday afternoon. Time to go home. No more f*cking patches to do.
Not so fast, buster. First we need you to change the toner cartridge on the LJ4 up on third floor.
hup-hup to it, now, IT boy. The girls in the secretary pool don't call you 'sysadmin' (while smirking) for nothing.
By doing so, I can't get to Hotmail, can't sign in to Passport, and most importantly, can't access Windows Update.
Hey, anyone astroturfing for Microsoft! Your own security recommendation means people can't access your sites. I am NOT turning on active scripting(i.e. disabling a security measure) so I can get the fix.
You guys need to make your site work without Javascript. Sheesh. How can anyone take you seriously?
No, Thursday's out. How about never - is never good for you?
By this logic, which I feel is a common path for businesses to take, using Internet Explorer and letting webmasters know that you do will harm our freedom to choose our client software in the future.
I don't understand why no one else has come forward and stated that they feel this way. For this reason, I refuse to use the software except in situations where it's seriously inconvenient to do otherwise.
I don't mean to be alarmist. If the web is only accessible from IE, a project will be started to supply a proxy for other browsers which interprets the data from the web server and converts it to nice, standardized HTML. This could get kludgy, and is the worst case scenario I see.
Not informative at all. Here's the real information: The patches can be applied to IE 6.0 OR IE 5.5 SP2 ONLY. If you do not have either of those you need to upgrade to one of them then apply the appropriate patch.
If you have not already upgraded to these versions then you are (and have been ) vunerable to numerous PAST holes. So if you haven't bothered to upgrade by now, why do you care about patching all of a sudden?
Please mod me up to 5 now thank you.
Contrary to popular belief, coding is not all free blow-jobs and beer. Those things cost MONEY!
Flamebait is typically written to elicit strong emotional response and name-calling from the target audience... this falls under the "troll" category which gives a more subtle feeling of disturbance, saying something usually inaccurate or incorrect in a seemingly reasonable manner to generate lots of "discussion". Let's go point-by-point:
Seeing as michael's story was neither misinformation nor an over-the-top rant (read the story), this plays on the popular opinion that slashdot gets a lot of stuff wrong all the time, as well as our obvious anti-Microsoft bias, to pretend that it was in fact an over-the-top misinformed rant.
Did they provide information about when a patch was available? At the time, they did not, so this is hardly misinformation. Whether they release a patch today or three months from now, "no information" is still "no information".
Correct me if I'm wrong, but I believe "M$" is childish name calling. "If it agrees with me, it's opinion, otherwise it's bias": This just about sums it up. There is nothing wrong with bias; there is no way to avoid it, claiming something is unbiased is a great indication that something is trying to be intentionally misleading. I read slashdot because the bias mostly agrees with my own. Perhaps your time would be better spent looking for a more agreeable forum, instead of trolling on this one.
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
Since Microsoft anounced it's policy of attempting to keep the lid on the security holes that exist within it's software, I would assume that 'known' means ones that they are willing to reveal to us.
So the word 'all' preceeding 'known' has no meaning since Microsoft itself admits to witholding the true extent of the damage its software can do to your system through security holes.
I consider this another decietful marketing attempt to make consumers feel safe about their products despite their worse than poor track record. They may not be outright lying, but there planting the seeds for others to do it for them. How many sysadmins will now send out an email saying that "IE will be free from all security bugs by installing this patch"? Of course that is a lie.
What happened? That bloody search-from-the-address-bar thingy had turned itself on. Oh well, I say, just go to Options -> Advanced -> Do Not Search From The Address Bar. I do this, type in "asdfa sdfsdfsa dfwer" (note the spaces) and POW: search-from-the-address-bar turns itself back on.
Much the same thing happens if you change the option and then restart IE.
WTF?
Cute!
Tried installing the 6.0 UberPatch on 2 separate boxes now, both running W2kPro sp2 with IE 6.0 installed with VS.NET beta2.
(IE v. 6.00.2462.0000 to be exact)
The installation quits with an error telling me I must have IE 6.0 to install.
Also seen as mentioned above similar effect on 5.x versions other than 5.5 with that version install.
Leaves me not exactly feeling warm and fuzzy about whether the actual patch will really patch the holes it's supposed to or not!
No Comment.