Slashdot Mirror
Microsoft Patches "Google Hack" Flaw In IE
An anonymous reader writes "As expected, Microsoft has issued an out-of-band security patch to address a remote code execution hole in Internet Explorer that was used in the recent Chinese attacks disclosed by Google. Ars Technica has all the download links you need."
Ugh, Microsoft! Get it right.
This just goes to show that OSS is better because the fixes come out fas...
oh this was IE?
Oh...
I mean... this patch just goes to show the lax security and horrendous coding of IE!
(In all seriousness, it's actually quite nice to see the hole fixed and tested in such a quick time. I think MS actually deserves kudos for the quick turnaround and out-of-band release)
It will force shutdown even if you don't check the box at the end of the installer. How can this be so wrong at so many levels.
...this does not apply to Mac users, because Mac's don't suffer from drive-by downloads and other malware. My PPC G5 running Safari on Snow Leopard is rock-solid and secure.
I take it you haven't heard the news? Granted, it's much more secure...but not secure.
People think that Mac's are expensive, but the safety and security alone are reasons to justify the high price. The sleek, advanced looks are just the icing on the cake.
Uh...OSX is what is safe and secure...not Apple hardware. Install OSX onto a hackintosh and it will be just as secure as your overpriced "icing". Macs ARE expensive, and the low-cost of upgrading to Snow Leopard just proves that you are paying far too much for hardware, not the software that it utilizes.
Come on. If you are gonna fanboy for a single system, at least get your facts straight.
Living With a Nerd
No matter how much ass kissing you do, Steve will never give you free Apple products. So just stop.
No sig for you. YOU GET NO SIG!
Now, if I had that kind of exploit (along with the Windows source code) to play with, and the skills to individually target a specific Google machine, I'd sure as hell make sure to sneak my exploit into the soon-to-appear Microsoft patch site...
And honestly, so far the chinese have struck me as the competent types.
This is a bit off-topic but I have nowhere else to post this. I have attempted to post the reports that Google has backed down in China and re-enabled search result filtering in Google.cn despite of the lack of REAL actions from the Chinese government in the last two days, but /. editors keep refusing to put this relevant in the headline. Right, how can we be critical of our new found American hero defending the precious "freedom" and fighting the evil China? How can a hero backing down to the evil China? Hero can't make fundamental principle error, or you are not allowed to know when it does. Can someone find a way to post this news report (which can be verified search "June 4" in google.cn and which I can't find any English language sources)?!
"0" "O" "0"
That's how I troll.
Sent from your iPad.
It will force shutdown even if you don't check the box at the end of the installer. How can this be so wrong at so many levels.
You don't get it. Shutting down your computer IS the security fix. If you start it up again, you're back where you started - with Windows and IE.
These posts express my own personal views, not those of my employer
So you finally show up your face!! Leave MySQL alone!!!!1 Grrr!!
Removing IE would save me bandwidth on all the patches and more importantly spare me the forced reboots.
I'd probably find that a lot of rendered local text would stop working without IE such as help pages, but I usually find google more effective than built in help these days any way.
Yeah, but they were real gentle-like, so it wasn't too big of a deal :P
Living With a Nerd
Then remove the entries from the start menu and take all the icons off the desktop. Of course this is not practical with XP but will work just fine with vista and 7 as the updates are independent of the default browser. It will work if you control the updates in XP and only enable IE when a critical update happens.
Microsoft knew about it last September.
You are being MICROattacked, from various angles, in a SOFT manner.
So IE has a buffer overrun. This wasn't something on port 135...so how did the Chineese get in.
Did it get in via a viewing of an email inside of Outlook?
Did some stupid user visit a bad site sent thru email?
The end user had to go to a site which then allowed a trojan to get install...is this what happened?
Psh, you think your safe? Not as much as me. I don't even run a fucking computer. I'm transcribing this via telephone to a guy in Malaysia.
I know it's exam season Slashdot, but seriously - my lecturers would be proud:
Say what you are going to say
Microsoft To Ship Emergency IE Patch
Say it
Microsoft To Issue Emergency IE Patch
Say what you said
Microsoft Patches "Google Hack" Flaw In IE
"Troll" does not mean "anything with which I disagree". It is trivial to find citations for the examples I give above. Try the China Aid Society first. Or read up on the Chinese Death Vans — they execute ten times more people per capita than the USA that they admit to and actually had vehicles created for the purpose. The condemned enter the vehicle, and they never leave — and their family is not permitted to see the body, which is considered extremely important by nearly all peoples on the planet. Organ supplies coming from China are all out of proportion.
Way to try to bury my opinion (on evil) and the facts (on China) at the same time, though.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I just remembered I hadn't ran `sudo apt-get upgrade` for a month or two.
Not that there's much danger of me getting hacked, but that's a 100mb download. Just imagine how much crap I'd be downloading if you waited for patch Tuesday!
So China will have to pay IE royalties next time.
...who read "Patents" instead of "Patches"?
*shudders*
They also very likely had no intention of fixing the bug, and no tenative patch. Then, the moment they start getting a boatload of bad PR from Google and a couple governments, they have a patch out extremely fast. So yes, it does prove they could have an amazing turnaround, if they spent the resources for it.
Ooooh, we all talk like com techs. Aren't we all so clever?
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
Ignoring the fact the PPC Macs do not run snow leopard which comes with intel only binaries....
Am I the only one who thinks the headline on this reads like common media spin? So basically Microsoft has a bug that happened to be used against Google and the headline reads like Google was doing some hacking. This only leaves me wondering how much did the Microsoft PR people paid to get that worded that way.
"Since I never use IE and never intend to" - by davet2001 (1550151) on Thursday January 21, @05:18PM (#30852740)
See my subject-line above, & realize, that SOME apps do not launch by "filetype associations" & FORCE a user into launching IE!
(Those apps should do it by your default browser file association, ala ShellExecute type API calls for instance in the Win32 API, which would INSTEAD summon the default webbrowser associated with webbrowser files like .html/.htm type file extensions etc. / et al):
An example thereof would be one like WinVulnScan:
Now, before I go anywhere pointing out that is "wrong" with it? Well, first of all - The author of it has the RIGHT IDEA in his application & by ALL MEANS!
HOWEVER, THE "PROBLEM":
He "forces" a user to use IE in it!
(As to that happening? Well - My guess is, is that he "hardcoded in" the actual std. commandline for IE into his app is why)...
Still - it's a decent app that helps secure your system though, by finding out what the latest patches are for your Windows NT-based OS' that your system lacks (easy to write one like it too pretty much, but, who has the time anymore (my days of shareware/freeware creation for instance, are LONG behind me now, & trust me: It's WORK, especially fielding users' requests & such)).
Fact is? Well - I've been thinking of writing that fellow (the dev of WinVulnScan) & running this idea by he... I just might @ that, now that I noted it here.
APK
P.S.=> Just pointing out an actual instance, with an application no less, that FORCES the use of IE on a user (albeit, not the BEST ONE probably, it was all I could come up with on "short-notice" is all)!
HOWEVER - There ARE other apps too, that do the same, mind you!
(Thank goodness though, the author of WinVulnScan only directs users to MS sites, which are MORE-OR-LESS, safer than others probably are (MS does get decent talent in coders (e.g.-> Dr. Mark Russinovich & Mr. Anders Heijelsberg as 2 examples thereof whom I respect a great deal for their accomplishments in this "art & science" of computing for example) & I expect their network tech/network administrator/network engineering staff is doubtless of EQUAL CALIBRE on that end also))... apk
Ars Technica has all the download links you need
And here they are...
This post was made in complete sincere seriousity; as such any attempts to derive humour are doomed to instant failure.
You could be one of those people who is stuck using XP SP1, so it won't install to begin with.
You can't run Snow Leopard on a G5. Intel only
Watch those corners
You can write to an in-use file. Unless somebody opened the file and specifically set the flag that dis-allows that. Go lookup FILE_SHARE_DELETE / FILE_SHARE_WRITE
Although I guess its a mistake to use facts here. How would we bash Microsoft then?!
Psh, you think your safe? Not as much as me. I don't even run a fucking computer. I'm transcribing this via telephone to a guy in Malaysia.
Hello, McFly? Wiretap.
Snow Leopard will not run on a PPC. Nice try.
But a PPC G5 can not run snow leopard.. As it only works with intel..
Rightly or wrongly, disabling IE for many industries is not an option.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
...this does not apply to Mac users, because Mac's don't suffer from drive-by downloads and other malware. My PPC G5 running Safari on Snow Leopard is rock-solid and secure.
-1 Offtopic? Lay off this guy. He's probably tired and cranky after just having ported Snow Leopard to the PowerPC.
Can I get a copy?
What has *science* done?!? -- Dr. Weird (ATHF)
The patch was released today - 21-Jan-2010.
So why do the files contained in "IE8-WindowsXP-KB978207-x86-ENU.exe" all have a date of "6-Jan-2010" or older?? The files contained in "IE8-WindowsServer2003-KB978207-x86-ENU.exe" are dated "22-Dec-2009" or older. Why?? And when the patch is installed, the files that are updated, like "mshtml.dll", have a date of "22-Dec-2009".
Wasn't the vulnerability, that this patch supposedly addresses, discovered (published) around 14-Jan-2010??
Anybody has an idea why there is a discrepancy??
Looks like Microsoft had the problem already fixed before it was even published. No??
he low-cost of upgrading to Snow Leopard just proves that you are paying far too much for hardware, not the software that it utilizes.
Maybe the hardware is actually no more expensive than the hardware in any Windows PC, and you pay $600 for the original OS X license, and $50 for each service pack. You can't use OS X on anything but Apple hardware, so they can get away with selling Snow Leopard retail for a loss compared to paying through the nose for the version of the OS a Mac ships with.
Kind of puts "MS Tax to shame when you put it like that, doesn't it?
Finally had enough. Come see us over at https://soylentnews.org/
Your IP address shows that you are in China? No? Then I'm thinking you don't see what the chinese see on google.cn.
DriverMax by Innovative Solutions:
It's "in the same boat" as WinVulnScan above: IT TOO, 'forces' a user into using IE as its browser (for downloading the latest drivers & displaying them)...
(Again though - it's a program with ABSOLUTELY THE RIGHT IDEA IN MIND (for performance this time though, more than security really) - it finds the latest drivers for your Windows 2000/XP/Server 2003/Server 2008/VISTA/Windows 7 32 or 64-bit Operating Systems)
APK
andy zebrowitz