Microsoft Patches 19 Flaws, 6 in Vista

Cheesy Balogna writes "Microsoft has just released seven advisories — all rated critical — with patches for at least 19 vulnerabilities affecting the Windows operating system, the widely deployed Office productivity suite and the dominant Internet Explorer browser. Six of the 19 vulnerabilities affect Windows Vista. 'There are patches for 7 different vulnerabilities that could lead to code execution attacks against Word, Excel and Office. Users of Microsoft Exchange are also urged to pay attention to one of the critical bulletins, which cover 4 different flaws. A cumulative IE update addresses six potentially dangerous bugs. There are the six that apply to IE 7 on Windows Vista. The last bulletin in this month's batch apples to CAPICOM (Cryptographic API Component Object Model) and could also put users at risk of complete system hijack attacks.'"

Comments

Re:Linux patches?

[A beautiful mind]

If the linux kernel people would ignore vulnerabilities, downplay them, take months for them to produce a fix, merge distinct vulnerabilities into single advisories and finally try to claim improved security, then I'd guess I would want to see stories about it on slashdot. So what bias?

Changes Default Browser

[Anonymous Coward]

I used Microsoft Update to download and install the new patches last night. Lo and behold, upon reboot, Mozilla Firefox was no longer my default browser. It appears one of the new patches resets Internet Explorer as the default browser. Easy enough to fix, but why would a patch change a system's default browser in the first place?

Cumulative IE 7 update 34,70 MB??

[edgrale]

What's up with the cumulative IE 7 update being 34,70 MB?
It is bigger than the x64 bit version!

Update also makes IE 7 the default browser

[edgrale]

Uh...

Did they even QA this thing? The size is huge and now it also stole the default browser setting.

Cure the disease and lose the patient

[CyberVenom]

When Microsoft releases "critical" patches like this, one of the primary motivations for users, home and business alike to apply the patches is fear of loss of data if their computer falls victim to one of the new exploits. To "help" users keep their systems up to date, Microsoft has provided the Automatic Update tool. Formerly this tool would insistently prompt the user to reboot once updates had been installed. Recently, however, the tool has taken to rebooting computers of its own volition if it is unable to elicit a user response to its prompting within 5 minutes. What's the big deal? Well, lets say you have just typed up a nice email but want to add a couple more points to it before sending it off, but you have to walk away from the computer for a while. (coffee break, etc.) And when you come back 6 minutes later you find that Windows has terminated all your open programs, lost your email, rebooted, and is now happily chiding away to itself in a little speech bubble about some new updates having been installed. Well, that's fine - install your damn updates, but either do it without destroying my work or wait until I give you permission!
(yes, I lost an email I was writing last night because of this and I'm still a bit sore...)

Did they fix the cltreq.asp query nonsense?

[Medievalist]

People running Apache are starting to see this junk in their logs:

GET /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=2614&STRMVER =4&CAPREQ=0 HTTP/1.1
GET /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=2614&STRMVER =4&CAPREQ=0 HTTP/1.1 This noise gets spewed at websites by IE if you load the latest version of Microsoft Office and turn on the discussion bar "feature".

You'd think sending these GETS to every single web site visited would be unnecessary (since IE can tell if it's connected to IIS, and only IIS is going to have cltreq.asp installed).

I'm guessing they didn't fix that one?

Re:Did they fix the cltreq.asp query nonsense?

[rthille]

Just create a symlink to /dev/urandom

Re:Linux patches?

[PixieDust]

Agreed, which is pretty much the same thing I'm saying. The Buffer overflow bit was just an example. But you can see this everywhere. You see it in ACLs in firewalls, routers, and switches. You see it in applications that let everything just go willy nilly. You see it in default installations of some OSes. You see it in the installations of applications, in websites, email-clients, hell even games. And before you say "What could POSSIBLY happen in a game that could be a security threat?" Let me illustrate this example...

Take a well known game, say, a first person shooter based in WW-II. Fairly good game, kinda fun. Let's say it's released witha BIG following, and several expansions are released for it. Now imagine, that since it's initial release, it has had a vulnerability just hiding, waiting to be discovered. It is discovered, by a couple of gamers just having fun. Say there's a voting system (for kicks, map change, etc.). Let's say people use this voting system all the time to talk to people who are still alive, because it displays the vote in yellow text to everyone. Some ingenious players discover that if your vote is for a map change, and you manually enter the command and name via console something like:

callvote change_map "Shotgunner camping in the vent!!"

It's been a while so forgive the syntax if it's wrong. In any case, these intrepid gamer friends are having fun, and annoying each other with vote requests that mean nothing, and just fill the screen with yellow text (repeating gibberish to flood the screen so the player can't see). Let's say during this, both game clients crash. Hmm, well that sucks. So you go back to having fun, the server is running on an actual server in the garage so it's no biggy. Same thing happens again. The clients just crash immediately after a vote is called that is an absurd length. Hmmmm.. You get another friend involved, they join, they also crash. Interesting. Then you crash 2 clients, and have the 3rd join immediately after to see people running in place, stuck in doors, etc. Server is still running just fine. Clients however, have crashed. Now intensely curious, you start digging, and find the exact point at which is goes from "Annoying Spam Vote" to Buffer Overflow.

Now through various methods you discover that this vulnerability is definitely client specific. The server is totally unaffected. The server simply hands everything off to the clienhts, which don't know what to make of it, stuff is outside the buffer, client craps all over itself. Now someone malicious enough could take that, and create something that would quite literally be capable of hijacking any machine the game client was running on, and the only thing the user would notice MIGHT be a game crash (hell if you do it right you might be able to do it without the game itself crashing), which happens occasionally anyway, so it's ignored. Now let's say you notify the producer of this Entertainingly Amazing game, and exchange a few emails with them. 4 patches later it still isn't fixed. Several expansions later it still is not fixed.

Unacceptable. Absolutely unacceptable. And this happens throughout the industry. THAT is why security problems, are as much of a thorn in our side as they are.

*flips two coins onto the table, returns the soapbox to it's upright and locked position, and returns to her regularly scheduled nonsense*

/rant off