Slashdot Mirror
Microsoft Flubs Patch, Putting Users At Risk
An anonymous reader writes "Microsoft is rushing to fix a flaw introduced by the company's latest security update to Internet Explorer. From the article: 'The flaw, initially thought to only crash Internet Explorer, actually allows an attacker to run code on computers running Windows 2000 and Windows XP Service Pack 1 that have applied the August cumulative update to Internet Explorer 6 Service Pack 1, security firm eEye Digital Security asserted. The update, released on August 8, fixed eight security holes but also introduced a bug of its own, according to Marc Maiffret, chief hacking officer for the security firm, which notified Microsoft last week that the issue is exploitable.'"
the MS has a security hole post has now become, trite, cliche, and dare I say it.... (-1, Redundant)
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
As long as, over the course of a year, the number of security holes plugged by the patches manages to outnumber the number of security holes introduced by these same patches, we're in real good shape right?
Where were you when the voynix came?
...to switch to Vista. That way, this sort of thing will never happen again. You betcha.
Weaselmancer
rediculous.
The update, released on August 8, fixed eight security holes but also introduced a bug of its own, according to Marc Maiffret, chief hacking officer for the security firm, which notified Microsoft last week that the issue is exploitable.
Chief Hacking Officer? I wasn't aware companies had those these days.
The theory of relativity doesn't work right in Arkansas.
Haha! This sort of thing would never happen if you used Ubuntu!
I'll probably be modded down for this...
whilst this is no doubt a bit of a "d'oh" moment for MS I doubt it will be a serious problem for anyone. * For this to have any affect on you you need to have SP1 but have the latest update of security for IE 6, surely if anyone updated regularly and applied security updates they'd be using SP2 anyway...
*If I'm wrong correct me, not being a windows user it's hard to remember what service pack is current
*''I can't believe it's not a hyperlink.''
Some clients accessing systems at the Chicago Board of Trade were rendered useless by this bug; the flaw essentially resulted in a crash on login. Didn't know until today that it was exploitable, though.
The solution for us was simple: install Firefox on affected clients. Problem solved, users happy.
-Rob
Biblical fiscal responsibility
Yes, but this is a hole created by a patch to fix a hole. On the whole, different and somewhat amusing. Or it would be amusing if I didn't have to administer Windows systems. :P
What if the Hokey Pokey really is what it's all about?
Please don't automatically reboot my machines again when the patch's patch is installed. I have the custom options in MS Update to allow me to control install/reboot for the updates. Well, it ignored that this week and rebooted 2 of my machines for me.
Then, I noticed that The Register had a couple of articles this week about the same thing happening to others.
Just who in the hell does MS think they are?
Oh, and if the patch's patch's patch needs a reboot as well, don't do that too.
Oh, and if.... nevermind.
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
Do you ever get the feeling that IE6 is like a cartoon characters hole-riddled row-boat?
The cartoon character (lets just say it's Elmer Fudd) tries to plug a leak with his thumb, only to have another pop open on the other end of the boat. He stretchs over there to plug it with his other hand. A third appears, and he has to use his toe. Eventually, the number of leaks outnumbers the number of limbs (Or at least, the number of limbs one is allowed to show on TV. *wink* *wink*), and the boat finally goes down. A Fox riding in a Motorboat then speeds by...
likey they rushed this patch to get it ready for the patch day and they did not fully test it. M$ will be better off with put the updates out when they are done not on a fixed time table.
My computer is full of snakes!
Microsoft's idea of testing patches
1.) Perform Windows update
2.) Wait for system to reboot
3.) If system turns back on successfully after reboot, release!
Wake me up when there is a security risk that doesn't need to go through IE.
Technoli
No, Microsoft will start a new initiative called the Genuine Double Patch Advantage (GDPA)
AT&ROFLMAO
If you unplug the power cord and make the laptop go to battery power, it will give up applying the rest of the updates. You'll then have to apply them the next day when you shut down.
I did that for about a week until I actually had enough time to sit there and watch it finish installing updates and shut down.