Slashdot Mirror
Microsoft To Issue Emergency IE Patch
CWmike writes "Microsoft will release its emergency patch for Internet Explorer on Thursday, the company said, as it also admitted that attacks can be hidden inside rigged Office documents. 'We are planning to release the update as close to 10:00 a.m. PST as possible,' said Jerry Bryant, a program manager with the IE group. Microsoft has updated the security advisory it originally published last week when it acknowledged a zero-day IE vulnerability had been used by hackers to break into the corporate networks of Google and other major Western companies. Google has alleged that the attacks were launched by Chinese attackers. Subsequently, security experts have offered evidence that links the attacks to China."
Affected Software
Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7
"Windows 7: with multi-core optimisations and improved app performance, be compromised faster than ever before!"
"Microsoft will release its emergency patch for Internet Explorer on Thursday, the company said as it also admitted that attacks can be hidden inside rigged Office documents. '
Now to be 100% compatible with Microsoft Office, the OpenOffice developers have to work day and night to get this bug/hole/exploit to work exactly the same way in OpenOffice too. I have heard OpenOffice people bitch and moan, "Microsoft keeps changing file formats and APIs deliberately forcing us to do so much of work catching up", now I sympathize. I understand how difficult it would be to code up a gaping security hole that works exactly like it does in the De-Facto Standard.
That brings up another issue. The ISO committee now has to redo the standards to allow this exploit into the OOXML-is-standard-too document. But fortunately the 6000 page standard definition was already in the form of a doc file with this specially crafted backdoor in place. So Microsoft was able to step in, do the modification needed, and set the flags to erase all evidence of the edit and exit. The committee chairman Soldou Tothem expressed his gratitude to Microsoft and complimented their foresight in incorporating such back doors into the standards document.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It only shows that warnings are never heeded when coming from the insiders and professionals. It takes global companies and several countries to ring the bell for MS to step up and patch exploits faster...
It's not really news that lots of exploits could (and probably were) abused for espionage (both corporate and international). But only now that 'teh evil chinese' are happily hacking along some action is taken.
This is exactly the kind of problem that could be avoided by listening to security experts.
Thanks M$ for giving a crap about the security of users, companies and countries... You're a few years too late stepping up the game, but please keep it up, we might as well have security as an afterthought instead of no security at all.
Comment removed based on user account deletion
Literal answer: Microsoft classes anything that's not released on Patch Tuesday as an emergency (aka "out of band", but potaYto, potaHto) patch.
If you were blocking sigs, you wouldn't have to read this.
In Microsoft "it's not an emergency, it's an..." parlance, that would be an out-of-band-aid.
If you were blocking sigs, you wouldn't have to read this.
Microsoft has given the Chinese government preferential access to the Windows Source code. They even set up a lab of security researchers to look for vulnerabilities in the code. I don't think leaks onto the internet have anything to do with it. It's kind of like all the possible disadvantages of OSS with none of the advantages.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
As I recall, the Chinese government has access to the Windows source code. Google's been claiming that the Chinese government launched the attacks, and security experts have backed them up. The obvious conclusion is that having the source gave the Chinese government the opportunity to develop a new attack against Windows.
While some might see this as an argument against Open Source security products, I see exactly the opposite. The closed source made it possible for the only party with the source to gain an advantage. In products where the source is available to everyone, there is no advantage to any party. Therefore the holes are found and sealed, instead of left to fester, like this one was.
For geek dads: Contraction Timer