Slashdot Mirror
Microsoft To Ship Emergency IE Patch
Grotendo writes "Microsoft plans to release an emergency patch for Internet Explorer very soon to counter targeted attacks and the publication of exploit code for a 'browse and you're owned' vulnerability in its flagship Web browser. The out-of-band update will be released once the company is satisfied that it has been properly tested against all affected versions of Windows. This could happen as early as this weekend." Microsoft has downplayed the seriousness of the IE zero-day, and insisted that it affects only IE6 even as security researchers close in on exploits for IE7 and IE8. Microsoft has had no comment about the firestorm that Google unleashed by directly accusing the Chinese of cyber espionage. ShadowServer has up a sobering post on the massive extent of the problem of "groups that can be referred to as the Advanced Persistent Threat."
I'm uploading the IE6 No More code to my website now. There's a point where users of outdated software need to be told there's four major cost-free options, including a much updated version of IE if they want to stick with IE. I'm almost thinking we should move from a warning to a service-denying error if this goes much further.
I think microsoft have commented on the firestorm... wonder why Ballmer wanted to make it out as no big deal?
targeted attacks and the publication of exploit code for a 'browse and you're owned' vulnerability in its flagship Web browser
IE 6 hasn't been Microsoft's flagship browser for 4 years.
Hikery.net - The best hiking site ever. Made by yours truly.
Microsoft is not "countering the targeted attacks".
Unless of course the German and France CERT teams recommendation to ditch IE is considered one.
It uninstalls all versions of Internet Explorer and installs Firefox with Adblock pre-installed.
Bravo Microsoft!
And that is running Windows Update and it isn't that good at doing that....
Tsukasa: All I really want, is to be left alone...
Make it painfully clear to IE6 users what they're doing.
My version, which is more educational for them.
Microsoft only has to say that IE6 is vulnerable and IE7-8 can't be exploited using same attack. The net will do the rest.
Do you find yourself mysteriously waking up in a back alley more than once a week?
Do you find empty HTML pages littering your desktop and you have no idea where they came from?
Do you discover new directories on your computer?
Get the IE Patch!
It comes in 4 strengths so you can be gradually weaned from the habit.
Week 1. IE 6 Patch. Internet cravings are pretty intense the first week so the IE 6 Patch is there to help you learn how to just say "NO".
Week 2. IE 7 Patch. It's easier to avoid launching IE. You still need to check Amazon or e-Bay from time to time but the edge has been honed down a bit.
Week 3. IE 8 Patch. You find it a lot easier to avoid clicking on the 'e' although you still lapse when you aren't thinking.
Week 4. Firefox. You've mastered the addiction. You're free to browse the Internet worry free. Even looking at the 'e' makes you nauseous.
Congratulations on taking the first step to breaking the IE addiction.
[John]
Shit better not happen!
Funny - that site's little code examples don't include Opera as one of the modern browser options. What's the author got against the big o?
Also.. adjust the code so it pulls all its data from your local server; there's no need for that site to know who your visitors are, and there's no need for your page to load any more slowly due to external connections than is absolutely necessary.
I'm so glad I upgraded from XP to Windows 7; with multi-core optimisations and improved app performance, I'm compromised faster than ever before!
This comes in handy to define the worst job a human can get!
.. not that maintaining IE8 would be much better but I can bet they pay u more!
Fixing major flaws in a 10 y.o. completely flawed browser...
You could call it: "Senior Ancient Flaws Engineer" or whatever!..
Ten points, m'lad, for Non Sequitur of the Day!!!
The world's burning. Moped Jesus spotted on I50. Details at 11.
Uhhh... yes the do (as of a few days ago): http://gmailblog.blogspot.com/2010/01/default-https-access-for-gmail.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+OfficialGmailBlog+(Gmail+Blog)
This post cannot be rebroadcast without the express written constent of Major League Baseball.
And what's going to happen to all those "IE only" web sites the government, public schools and other agencies like to use?
"If any question why we died, Tell them because our fathers lied."
Instead of releasing more trash - recall IE. Problem solved.
Hope is the currency of fools
I think you might gotten trolled. But I'm not entirely sure. But yes, GMail is now SSL by default.
Opera is on the Wii, DS and of course many a mobile phone whose own browser sucks, but often with a fake user_agent string.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Wow, so that's... 4 days after full disclosure that they announce their response.
"Could be here as soon as this weekend", which is still more than a week from the exploit being published. That's swell.
Anyone else grateful MSFT doesn't run the fire department?
I just updated to 9.3 after having shut off the reader auto update! However after reading the specifics of how reader before version 9.3 was compromised it is rather telling that the attack vector was a call to a WMP that left open space. It left buffers open but not in the Reader section of the malloc. This would indicate that there might just be another un-patched hole in external program calls to Windows Media Player or perhaps in WMP itself. It would not surprise me if the Reader exploit was actually another WMP exploit involving bad memory allocation practices from Microsoft!
And what entity in the U.S. is protecting us from Chinese cyber attacks?
Just curious. Who would be putting us at risk by 'letting their guard down'?
deleting the extra space after periods so i can stay relevant, yeah.
ie = internet exploiter -- I think a can of cat food has more security than anything MS produces ....
Browser independence, is what you should have done/insisted on in the first place, which would have resulted in push back on M$ non inter-operable crap.
At least two governments officially stating to avoid IE, others in fear, every single web developer on the country hating you, Google getting hacked, and every security expert on the planet laughing at you?
Wow. Just wow.
May I extrapolate from that, what it would take, to get a real Bugzilla for IE and make it follow recent standards?
My guess: Inter-dimensional time war with Lovecraft’s the old ones, lead by Cthulhu, fighting the Shrike and its army, armed with gamma ray bursts and black holes, using giant stars as ammunition.
On the other hand: That would be awesome!
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Has been stated and rebutted literally millions of times, the problem with M$ crap is not that it is popular, it is that it is criminally defectively by design, and because of Backward Compatibility, and secret api's shared only with valued customers they absolutely can never fix it. Anyone tells you about OS secrets is selling snake oil.
1. There are 3,500 Windoze api calls, POSIX < 200, Linux ~ 250, new functionality over 10 years,
2. Windoze will execute any crap base on ".ext" so it will just execute ".exe" files, no question, no request permission,
3. COM automation, the keys to the system,
I operate a number of linux boxes, connected directly to the net, and after a while I realised that firewalls were a waste of time and too much a blunt instrument, and that I could trim and lock down most services better on an ad hoc basis. eg TCP wrappers and some, 6 IPTABLES rules. The only thing, recently, is attempted SSH brute force attacks and the suggested, and contorted response to them, which was SysAdmin gone mad. SSH can be patched to restore the retry-delay and back-off algorithms which are used for normal logins, and to tar-pit the attacker, and in my experience this works real well, the botnets go, and dont return.
Way to go, citizens. March on!
Yes, there is. If you have a capped internet connection, downloading 100MB of updates can be annoying, but you allow it. Then you return and find out it actually consumed 300MB and it still failed to install it.
I want it to ask me before retrying!
Dilbert RSS feed
1. Tabs are Tabs,
2. You only need a sandbox if you have open wounds, IE6 or are Immune Compromised that ie: Windoze* IE*,
3. You don't need NoScript,
4. ACID is a database test, and has nothing to do with HTML compliance, your ass and ignorance is showing!
5. We do care about HTML compliance and a commitment to inter-operate properly since it reduces complexity and simplifies testing, both of which cost a lot of money.
Isn't it time you moved out of your mother's basement?
I thought that was a really slick marketing twist on someone's part.
It should RUN for 10 years on stable HARDWARE.
Only a complete M$ dummy would pull that naive crap, there are SunOS 4 systems still running reliably in server rooms.
I just despair at your credulousness and stupidity.
www.mozilla.com
I am the unwilling control for my Origin.
Sane people don't use IE 6 anymore, that browser needs to die!
They look totally different to the popup-style messages on compromised websites saying "Your Anti Virus is out of date! Download our version!" or "You have been infected by Win32.BullRubbish.exe.foobar! Upgrade to New Anticrap UberVirusWare 2011!"
You're training them to download stuff from the web, from sites they don't regularly visit / don't trust, because a popup told them to.
Well done.
Finally had enough. Come see us over at https://soylentnews.org/
Isn't "browse and we own you" the brunt of the IE EULA, anyway ?
What a depressingly stupid machine.