Zero-Day Team Launches with Emergency IE Patch

Holy Mother of Thor writes to mention an eWeek article about a third-party patch for Internet Explorer. A dark horse security group formed after the WMF attacks in late 2005, the ZERT (Zero Day Emergency Response Team) has released a patch to attempt to slow the malware attacks on Windows. From the article: "'It is clear that we are dealing with an underground group of people who are writing exploits for profits. They are waiting for Patch Tuesday to pass, then it becomes Exploit Wednesday. We're seeing these zero-days in the wild, timed precisely to guarantee at least an entire month to spread,' Stewart said in an interview with eWEEK. Stewart, who is volunteering his reverse-engineering skills and time to ZERT in his private capacity, wrote an early version of the VML (Vector Markup Language) patch the group released Sept. 22 and worked closely with others to fine-tune the update to minimize potential glitches."

Comments

Who didn't see this coming

[George Beech]

I mean really, it just seems logical if they are only going to patch once a month, then the bad guys will go after every hole that wasn't patched the day after updates are released.

I'm just amazed that it took this long for it to become big news that this kind of thing is going on.

Alternative: Unregister vgx.dll

[Noksagt]

The latest Security Now! episode had information on this exploit. Those who have policies in which they can't install third party patches do have an alternative:

regsvr32 -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"

When MS comes out with a patch,

regsvr32 "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"

will re-register it.