Slashdot Mirror
IE Download.Ject Exploit Fixed
Saint Aardvark writes "Just in time for the weekend, the
Internet Storm Center is reporting that Microsoft is providing
a fix for the Download.Ject vulnerability that hit IE late
last month. The press
statement says that it'll hit Windows Update later
today..."
This configuration change to the Windows XP, Windows Server 2003 and Windows 2000 operating systems improves system resiliency to protect against the Download.Ject attack.
In addition to this configuration change, which will protect customers against the immediate reported threats, Microsoft is working to provide a series of security updates to Internet Explorer in coming weeks that will provide additional protections for our customers.
Please note that this isnt a fix, it is only a configuration change to help defend against the problem and nullify the threat from the known places it is spreading from. No doubt that within a short time, whoever is behind the virus will find other places to have the virus attack from. This is just another "this will help for now, please wait for the real fix" incident from Microsoft.
That assumes I remember to run Windows Update... Why do I have to do it myself Microsoft! I want automatic and forceful patch downloading and installation! Sure, you could throw in an extra DRM patch here or there... but I don't care, I'm lazy!
Help Brendan pay off his student loans
You can have Automatic Update download and even install things on Windows XP.
Got it, but in the meantime I switched to Mozilla Firefox and I honestly don't see any reason to go back to IE apart from a handful of aggressively IE-only sites.
Never email donotemail@WeAreSpammers.com
The Department Of Homeland Security said it is safe to go back to using Internet Explorer as your main browser...for about 10 minutes, when the next exploit will be released.
So, the vulnerability will hit Windows Update later today? How do they know? (Other than the fact that Microsoft is running security at the Windows Update site, of course.)
If aspiration is a virtue, achievement cannot be a vice.
That means all the sys-admins will have to work late on a Friday night making sure its installed.
Excellent timing.
Unknown host pong.
"Late last month"
vs.
"A week or so ago"
I know Microsoft is not one for timely updates, but this wording makes it sound like Microsoft has been sitting on this particular problem a lot longer than they have.
They might've found one way to prevent the auto-download, but there are still plenty of ways to force a download using ActiveX. Even with that, there are still a few ways to run them too; methods that are still unknown to most assholes trying to get you to buy their pills that give you bigger penis-breasts-ego-wallet-spyware-car-wife-mom-WMDs .
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
when you set high security you cannot even use windows update, and putting windows update into trusted sites does not work right
Snowden and Manning are heroes.
Late last month actually means June 25th. Which by my count was only 1 week ago. But it wouldn't be a bash microsoft topic without a little twisting and manipulation.
Download.Ject.A
Download.Ject.B
Download.Ject.C
Download.Ject.D..............
What use are IEs extra features if they have to be turned off by default.
ActiveX should never have been embedded into a browser in the way it has been. Yet most of the sites that I have to use IE for is because of ActiveX controls.
Microsoft tricked a lot of the world into using ActiveX and now they're paying the price.
I can hear the support conversations already -
"Yes, if your security zone is set to high your computer won't be vulnerable. But if you want to view anything with ActiveX (read: multimedia) you'll have to turn these vulnerabilities back on."
Does anyone else find this mildly insane ?
[ Monday is a terrible way to spend one seventh of your life. ]
Wonder no more. 11 months of IE exploits and at least a year or two's worth of future exploits can be avoided with one simple registry change. The problem that MS has isn't that they are incompetent, it's that they insist on leaving default features that are used by 1% of administrators like myself.
98% of spyware released since January 2004 can be avoided with the above registry fix. If you think that statistic is outrageous, I challenge you to find one piece of malware installed without using ADODB.Stream in one way, shape, or form. Be forewarned, I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.
And, while it's unfortunate that many people don't (or can't) run Windows Update, it works well for people with fast connections who are behind firewalls so their systems don't get screwed up before they can patch them!
Best Buy can have you arrested
Black Knight: Have at you.
King Arthur: You are indeed brave, sir knight, but the fight is mine.
Black Knight: Oh, had enough eh?
King Arthur: Look, you stupid bastard. You've got no arms left.
Black Knight: Yes I have.
King Arthur: Look.
Black Knight: Just a flesh wound.
It's all fun and games until someone loses the key to the handcuffs.
Microsoft e-mailed me the patch some time ago, like they do with all their other security updates. I install them all as they come in, and keep my system virus free!
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
It was only mentioned two posts before this that CERT advised people to stay away from IE, even though CERT released that advisory on June 10, and it was even reported on BBC on June 14. Now this story comes along mentioning the patch will be available later today? The CERT advisory could have been published on Slashdot nearly a month ago, but conveniently is published on the same day as the fix is released. Was it intentional to keep information about the CERT announcement off of Slashdot until the fix was released?
Stupid Mods. If you don't know what the poster is talking about, don't mod it. Just leave it and go to the next post.
He is referring to this Security Focus article
From the article,
Still, speaking at a press conference here Monday, Gates told journalists that Microsoft's patching process compares well with competitors'. "You know, the time -- the average time -- to fix on an operating system other than Windows is typically ninety to a hundred days," said Gates. "Today we have that down to less than forty-eight hours."
I already posted link to this article here
Free XBox, PS2
Dear Microsoft,
I am writing concerning downloading the most recent Windows Updates. I am unable to obtain them as your site requires IE, and the government recently suggested that users cease use of IE.
Please help!
-Adam
The slashdot rendering bug (bug 217527) can happen even without AdBlock. It's fixed on the trunk, so if you switch from 0.9 or 0.9.1 to a trunk nightly, you won't see the problem any more.
The shareholder is always right.
FullDisclosure: ADODB.Stream object
Any attack vector that relies on an ActiveX control can be stopped by setting the killbit. This is IE security 101.
-weld
"Second, I have never -- that means NOT EVER -- seen an IE fix that broke my machine worse than a virus would."
Hmmm. Well THERE's a ringing endorsement....
No security vulnerabilities have actually been fixed here; all that's happened is that some functionality (which exacerbated existing security holes and was probably a bad idea to begin with) has been disabled.
Okay, everyone has had a great deal of fun at Microsoft's expense today with the stories of Dept of Homeland Security dumping IE, and Microsoft taking nearly a month to fix a BIG exploit in IE. But I wonder if Microsoft's problems are less a function of them 'getting it' as much as it is a case of them being a 'victim of their own success'. Follow along with me for a minute.
When MS started its rise to the top, they hired as many of the brightest minds as they could to make their software the best of class. While many of us probably find the corner-cutting a bit too much to take, it is possible to have both world-class software while meeting a marketing deadline. It happens, but less frequently than MS or its defenders/supporters would like to think it does (lightning striking the same point twice *without* a lightning rod).
They continued to compete heavily in the OS market despite the fact that they initially wanted to be nothing more than a computer language business. The OS was to be the cash cow that would allow them to be a more effective language business. But now they own the OS business and are driving their business model into other ventures (consoles, entertainment centers, telephones, automotive brainboxes, etc). They just follow the same formula that lead to their smashing success in moving into the OS and office app market: buy the best brains in the field and use their project management skills and VOILA!, they are the new masters of the [insert market segment].
But consider the sandbox their bright minds play in: a homogeneous computing environment with computer scientists guarding the facility from outside intrusion. As has been noted in another slashdot article, Microsoft's products work wonderfully inside of Microsoft's campus.
They have extremely talented people working with the highest-end equipment in an environment where everything works nearly 100% of the time. Is it so surprising that they do not view the world the way we do?
After all, most of the companies that I have worked for are staffed with (largely) computer-illiterate people and whose firewall is maintained by a PFY with a high-school diploma.
Perhaps it would be better for Microsoft if they force their developers to create their products in environments that their customers use. In fact, maybe they should send their developers to test their products in the heterogeneous environments of their customers for a month or two.
Let them work the bugs out on their time for a change.
"Rocky Rococo, at your cervix!"
According to SecuritiyFocus. Windows 95, 98 and ME users are also vulnerable. So why is this patch only for Windows NT, 2000, XP, and 2003?
It does NOT run on Windows 98.
Oh, I remember, Microsoft only produces patches for "supported" (if that's what you can call it) products.