Slashdot Mirror
Patch Tuesday — IE7 Clean
jginspace writes "As per the advance notification, Microsoft's monthly security bulletin, released yesterday, addressed five general Windows issues and one in Visual Studio. It also included a fix for a problem in Outlook Express for a total of seven updates. As patch Tuesdays go it was fairly unremarkable. The only general Windows update labeled 'critical' is for a flaw in Media Player. As usual, there's a cumulative update for Internet Explorer, but significantly, the only versions of IE affected are 5 and 6. Version 7 is clean — which is welcome news in this first update since the upgrade was pushed to the world last month. Microsoft was silent on the two zero-day Word holes, one reported here and a new one. Sans is calling this 'Black Tuesday' and recommends patches be applied urgently for the Visual Studio and Media Player vulnerabilities. Sans is recommending the Heise Offline Update utility covered in a previous story."
Would I be trolling here if I wondered out loud: Did Microsoft really not find and fix anything with IE7 during the last month that they considered worthy of pushing out with this latest bulletin? Consider that this is the first set of updates since IE7 was pushed out to the whole world and how the inclusion of a patch for IE7 would be met with a jaundiced 'business as usual'. I suppose Microsoft just can't win on this can they?
I uninstalled Outlook Express around 2 years ago using "Add/Remove Windows Components".
However, Windows/Microsoft Update keeps applying patches for "Outlook Express".
I'm sure that if I searched my drive for Outlook Express (or the correct search pattern), I would find that Windows never really uninstalled Outlooked Express. Lies lies lies!
What a headline... I thought for a second there that they had recalled IE7.
I assume that only security vulnerabilities will be patched in XP's IE7 until Vista is on the same update schedule as XP. These patches will be fashionably late and will only address the most severe issues with the browser, and that simple compatibility glitches will go unanswered. Once Vista is really rolling along there will be more consistency.
FairTax baby!
I fully assume that IE7's phishing filter, like Outlook 2003's Junk Mail Filter, will receive monthly updates from Microsoft to keep it up to date with the latest phising "heuristics".
Depending on your WSUS server's settings, Outlook 2003 Junk Mail Filter updates (and likely IE7 phishing filter updates) may appear as "Critical Updates" despite not actually being security patches for %0-day_exploit_01%.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
How much have the network protocols changed since IE was released? And now in version 7 we actually have a program that can (supposedly) capably utilize the protocols? Hell. I guess this is news.
TLF
I do not respond to cowards. Especially anonymous ones.
The article text is not well-written. It makes mention of a "Sans," without bothering to identify what Sans is. I assume they don't mean the SANS Institute? Just rubbish, not at all well-edited.
Slashdot: Playing Favorites Since 1997
It's good to know, that if they don't release patches, that means IE7 is clean from bugs. I got all comfy and calm now.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
This may be projected as a compelling reason to upgrade your web browser at least !!
It's official, IE7 is clean. This shows that Microsoft have gotten all of the bugs and there will be no more patches, ever. Uninstall your virus and spyware scanners - they're not needed anymore.
Seriously, has the situation come to a place for Microsoft where a month with no patches for IE is actually news?
Version 7 is clean -- which is welcome news in this first update since the upgrade was pushed to the world last month.
I know you Americans consider "the USA" the same as "the world", but I can assure you that IE7 was NOT pushed out in the Dutch version of Windows XP. It is not even available as an optional package in Windows update.
And I think it is the same in many other countries.
In Soviet Union Politburo declare Chernobyl clean.
Enjoy the Zero Day parade, now with improved security.
Domestic spying is now "Benign Information Gathering"
12/12/2006: Update for Internet Explorer 7 for Windows XP (KB928089).
This update resolves a performance issue with the Phishing Filter.
-- Rastignac was here.
IE7 is not clean: Secunia shows there are 3 unpatched holes:_ 2006
http://secunia.com/product/12366/?task=advisories
IE7 was a rewrite from scratch. So any bugs on IE5/6 won't carry-over. And this also means bugs in IE7 need not be there in IE5/6.
does the autoupdater insist on nagging me every 15 minuttes about restarting???? It's so bloody annoying, I know you just updated some of my software, but I'm working so shut the f*** up!
Anyways, you can ask it to bugger off by going to control panel -> administrative tools -> services, find automatic updates, right click and press stop, that will stop it from nagging you about restarting.
I have to say that if there was just one Microsoft product that needed patching, IE7 would most certaily be it. I've had numerous clients complain about the absolute incompetency of this browser to do what it is fundamentally made to do - view web pages. Even on my own system I encountered at least one complete crash of IE7 every..single..day that it was installed, not to mention the painfully slow performance of the product. Granted, I didn't do everything in my power to make it stable - was running on default settings when I knew very well I could turn these off and run with the bare minimum of settings - but just the hastle of going to HP web sites and having the content blocked as potentially malicious code or the way the program can't render slashdot comments properly, or most web sites for that matter. urgh. It may be secure, but it doesn't do what I would expect a web browser to do - browse the web. And the browser tab functionality lacked the one feature I have come to expect from tabbed browsing - for the browser to remember what pages I was looking at, so that every time it crashed I didn't have to work out what I was up to. I know this is a big bitch session about the obvious shortcommings of IE7, but come on!! how can you release such an obviously flawed product and neglect to update it a month after its release? On a side note - since removing IE7 from my machine my notebook will now successfully hybernate again. Coincidence?
Secunia released a new tool last week. You can use this to verify that you have the latest secure versions of software installed, including MS updates. http://secunia.com/software_inspector/
The organization referred to as Sans in this article is the SANS Internet Storm Center found at http://isc.sans.org/ You can find the reference to Black Tuesday and more information on this update at http://isc.sans.org/diary.php?storyid=1928
Seems every exploit mentioned lately has been labeled 0-day. I guess they must have solved the problem of the [1-9][0-9]*-day exploits. Of course if we can limit the flaws to only a single day, it limits the time those nasty hackers have to break the systems! Right? What?
They're there affecting their effect.
I'm searching for where SANS has recommended the Heise Security Offline update script and cannot seem to find this information anywhere on the SANS site.
If I can find this evidence it would go a long way towards convincing my security group that my IT organization can use this to develope iso cds.
When you install IE7 and Print emails received in html using outlook. There is a bug where the emails print in about a font of 1.n -us/default.aspx?dg=microsoft.public.outlook&tid=5 3028d9d-6499-4e5c-a928-71fd00e01da1&p=1
http://www.microsoft.com/communities/newsgroups/e
This sure seems like a problem. Maybe not critical but if they ladies in my office dont stop complaining about it then it might become critical.
You know the one who claims not to have caught an STD, but you've seen her around the free clinic a few times? You know the one. She has documents that say she has a clean bill of health but somehow you don't think there's a Doctor Fakopsky.
Then of course you go out with her and the next day you know what falls off? We've all had that experience, haven't we?
Oddly enough that sounds exactly like IE7. I'll stick with my hotter girlfriend, Firefox. It's true she might have "enhancements" and she might be a little "slower" but at least she's not sleeping around like IE.
So we have these vulnerabilities with Outlook Express, Internet Explorer, and other parts of the OS. I'm sure there are a bunch of people... ummm me... that are still using the now unsupported OS's of 98 and ME...
Can Zone Alarm, router firewall, along with Ad-Aware, keep things more or less safe for ME, or is it really time to upgrade?
It's not what your Sig can do for you, but what you can do for your for your Sig.
Old news. You can turn the fishing filter off - in fact, when you first run IE7, it asks you if you want to turn it on.
They don't track the computers the filter requests come from. It's certainly techically possible that they could, but conspiracy theories aside, they don't.
DATABASE WOW WOW
I know you Americans consider "the USA" the same as "the world", but I can assure you that IE7 was NOT pushed out in the Dutch version of Windows XP.
Silly you. Dutchistan is in a completely different world - there's an ocean between them.
DATABASE WOW WOW
Since MS has such a regular release schedule for updates, it makes sense that the virus writers have a schedule too - relase it the day after all the security checks. Expect a hole to be announced and exploited within the week.
Or, I could be wrong and the numbers are too low to make it worth the effort. Or, just maybe, Microsoft actually did build a secure product....
There's a cross-window injection problem, which could let sleazebuckets.com (if you're viewing them at the same time as you visit your bank) place a popup on top of yourbank.com. This kind of problem is not new. On the one hand that means Microsoft really should have prevented it, on the other hand it means that it's already best practice to have nothing else open when visiting a sensitive site.
There's an address bar integrity problem which "could allow phishing". Again, MS should have used their experience to head this off, but normal good practice by the user will avoid the problem.
The last will read content from another site, but only if Javascript is running.
I've had to advise people that there was no way of using IE6 safely. So far IE7 is looking better than that.