Slashdot Mirror
Microsoft Flubs Patch, Putting Users At Risk
An anonymous reader writes "Microsoft is rushing to fix a flaw introduced by the company's latest security update to Internet Explorer. From the article: 'The flaw, initially thought to only crash Internet Explorer, actually allows an attacker to run code on computers running Windows 2000 and Windows XP Service Pack 1 that have applied the August cumulative update to Internet Explorer 6 Service Pack 1, security firm eEye Digital Security asserted. The update, released on August 8, fixed eight security holes but also introduced a bug of its own, according to Marc Maiffret, chief hacking officer for the security firm, which notified Microsoft last week that the issue is exploitable.'"
the MS has a security hole post has now become, trite, cliche, and dare I say it.... (-1, Redundant)
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
As long as, over the course of a year, the number of security holes plugged by the patches manages to outnumber the number of security holes introduced by these same patches, we're in real good shape right?
Where were you when the voynix came?
...to switch to Vista. That way, this sort of thing will never happen again. You betcha.
Weaselmancer
rediculous.
The update, released on August 8, fixed eight security holes but also introduced a bug of its own, according to Marc Maiffret, chief hacking officer for the security firm, which notified Microsoft last week that the issue is exploitable.
Chief Hacking Officer? I wasn't aware companies had those these days.
The theory of relativity doesn't work right in Arkansas.
Haha! This sort of thing would never happen if you used Ubuntu!
I'll probably be modded down for this...
whilst this is no doubt a bit of a "d'oh" moment for MS I doubt it will be a serious problem for anyone. * For this to have any affect on you you need to have SP1 but have the latest update of security for IE 6, surely if anyone updated regularly and applied security updates they'd be using SP2 anyway...
*If I'm wrong correct me, not being a windows user it's hard to remember what service pack is current
*''I can't believe it's not a hyperlink.''
Some clients accessing systems at the Chicago Board of Trade were rendered useless by this bug; the flaw essentially resulted in a crash on login. Didn't know until today that it was exploitable, though.
The solution for us was simple: install Firefox on affected clients. Problem solved, users happy.
-Rob
Biblical fiscal responsibility
Yes, but this is a hole created by a patch to fix a hole. On the whole, different and somewhat amusing. Or it would be amusing if I didn't have to administer Windows systems. :P
What if the Hokey Pokey really is what it's all about?
Please don't automatically reboot my machines again when the patch's patch is installed. I have the custom options in MS Update to allow me to control install/reboot for the updates. Well, it ignored that this week and rebooted 2 of my machines for me.
Then, I noticed that The Register had a couple of articles this week about the same thing happening to others.
Just who in the hell does MS think they are?
Oh, and if the patch's patch's patch needs a reboot as well, don't do that too.
Oh, and if.... nevermind.
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
Do you ever get the feeling that IE6 is like a cartoon characters hole-riddled row-boat?
The cartoon character (lets just say it's Elmer Fudd) tries to plug a leak with his thumb, only to have another pop open on the other end of the boat. He stretchs over there to plug it with his other hand. A third appears, and he has to use his toe. Eventually, the number of leaks outnumbers the number of limbs (Or at least, the number of limbs one is allowed to show on TV. *wink* *wink*), and the boat finally goes down. A Fox riding in a Motorboat then speeds by...
likey they rushed this patch to get it ready for the patch day and they did not fully test it. M$ will be better off with put the updates out when they are done not on a fixed time table.
My computer is full of snakes!
Microsoft's idea of testing patches
1.) Perform Windows update
2.) Wait for system to reboot
3.) If system turns back on successfully after reboot, release!
Wake me up when there is a security risk that doesn't need to go through IE.
Technoli
No, Microsoft will start a new initiative called the Genuine Double Patch Advantage (GDPA)
AT&ROFLMAO
I really don't understand why Microsoft doesnt just use their marketing power and explain how executing code from another machine is actually a feature. There is really no need to purchase applications such as pcAnywhere. Thank God for Microsoft saving us all that money!
Internet Explorer 6 Service Pack 1 unexpectedly exits after you install the 918899 update
Additionally they go on to say in this article: A new version of security update 918899 is currently in development and will be released to all Microsoft Internet Explorer 6 Service Pack 1 customers by August 22, 2006.
This patch was NOT released today - they LIED! :-)
Since that change, the crashes stopped at least but now that this is out I have much move incentive to upgrade our last few W2K machines up to WinXPSP2.
Namaste
If you unplug the power cord and make the laptop go to battery power, it will give up applying the rest of the updates. You'll then have to apply them the next day when you shut down.
I did that for about a week until I actually had enough time to sit there and watch it finish installing updates and shut down.
And Bill Gates has said this new OS is going to be the whing dinger of all time.
Meaning, the number of serious holes is going to be astonishing, because they are so sophisticated and well hidden that only the best hackers can find and exploit them without users and IT admins finding them.
Aaaaak
I was once running an experiment for a prof. The computer controlling the experiment has a GPIB card, which is controlling several other devices in the room (PID temperature controller, Lock in amp, yada yada yada.) The software running the experiment was written in LabVIEW.
I'm in the middle of a nine-hour experiment when this dialog box pops up. "Your computer will restart in 5 minutes to apply updates."
Now, let's review. What have I done wrong?
- This isn't a server
- AFAIK there is no "LabVIEW" for Linux. I could have written all the GPIB software in C but then no one else would have the expertise to change it, plus getting the card to work in linux would probably be hell
- I'm not using IE
- Windows update is on? Oh, that's what I'm doing wrong.
Luckily my software is much better written, so I was able to discontinue and resume the experiment wihtout losing data. But still, is this the kind of OS that is intended for a production environment? "Who the hell do they think they are" indeed."Live as if you'll die tomorrow." Ridiculous. You could die later today.
See what I mean. All Hail the 'Soft.