Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Patches "Google Hack" Flaw In IE

Posted by timothy on from the you-saw-this-coming dept.

An anonymous reader writes "As expected, Microsoft has issued an out-of-band security patch to address a remote code execution hole in Internet Explorer that was used in the recent Chinese attacks disclosed by Google. Ars Technica has all the download links you need."

19 of 142 comments (clear)

  1. Microsot by SimonTheSoundMan · · Score: 5, Funny

    Ugh, Microsoft! Get it right.

    1. Re:Microsot by lousyd · · Score: 3, Funny

      I thought it was a clever, subtle jab at MS. Like, they're sots. Tiny sots.

      --
      If aspiration is a virtue, achievement cannot be a vice.
    2. Re:Microsot by draconx · · Score: 4, Insightful

      No, what slashdot needs are editors: people who read and correct errors in written works prior to publication.

  2. Quick turnaround! by Anonymous Coward · · Score: 5, Funny

    This just goes to show that OSS is better because the fixes come out fas...

    oh this was IE?

    Oh...

    I mean... this patch just goes to show the lax security and horrendous coding of IE!

    (In all seriousness, it's actually quite nice to see the hole fixed and tested in such a quick time. I think MS actually deserves kudos for the quick turnaround and out-of-band release)

    1. Re:Quick turnaround! by Anonymous Coward · · Score: 4, Funny

      The cynic in me wonders iff this wasn't such a visible and highlighted Google highlighted would they bothered to push it sooner or even at all or even to let people know there is a problem

      Could you repeat that? My gibberish-to-english translator is on smoke break, and I'm nowhere near as fluent as he...

    2. Re:Quick turnaround! by UnknowingFool · · Score: 4, Insightful

      No it goes to show how fast MS can release a patch (and out of their normal cycle) when face with a large amount of negative PR. Normal vulnerabilities usually have to wait til Patch Tuesday. But when Google announces that IE was to blame in a large number of attacks, both France and Germany advises their citizens not to use IE for a while, MS better patch it sooner than later.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    3. Re:Quick turnaround! by aztracker1 · · Score: 3, Informative

      Apparently some of the bugs were reported to MS back in September. So it really wasn't *that* fast.

      --
      Michael J. Ryan - tracker1.info
    4. Re:Quick turnaround! by UnknowingFool · · Score: 4, Insightful

      It only proves my point. MS sat on the bugs for months and only released a patch after public disclosure by Google. How much longer would have they sat on them if it wasn't for the bad PR.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    5. Re:Quick turnaround! by Dishevel · · Score: 3, Insightful

      How much longer would have they sat on them if it wasn't for the bad PR.

      Stupid question. Answer is of course "Forever!".

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
  3. WTF! FORCED SHUTDOWN by indi0144 · · Score: 5, Informative

    It will force shutdown even if you don't check the box at the end of the installer. How can this be so wrong at so many levels.

    1. Re:WTF! FORCED SHUTDOWN by mrjohnson · · Score: 5, Insightful

      Rebooting to upgrade a browser is at least five levels of wrong!

  4. Re:Of course... by Pojut · · Score: 3, Insightful

    ...this does not apply to Mac users, because Mac's don't suffer from drive-by downloads and other malware. My PPC G5 running Safari on Snow Leopard is rock-solid and secure.

    I take it you haven't heard the news? Granted, it's much more secure...but not secure.

    People think that Mac's are expensive, but the safety and security alone are reasons to justify the high price. The sleek, advanced looks are just the icing on the cake.

    Uh...OSX is what is safe and secure...not Apple hardware. Install OSX onto a hackintosh and it will be just as secure as your overpriced "icing". Macs ARE expensive, and the low-cost of upgrading to Snow Leopard just proves that you are paying far too much for hardware, not the software that it utilizes.

    Come on. If you are gonna fanboy for a single system, at least get your facts straight.

    --
    Living With a Nerd
  5. Shutdown IS the fix by syousef · · Score: 4, Funny

    It will force shutdown even if you don't check the box at the end of the installer. How can this be so wrong at so many levels.

    You don't get it. Shutting down your computer IS the security fix. If you start it up again, you're back where you started - with Windows and IE.

    --
    These posts express my own personal views, not those of my employer
  6. Re:Google has BACKED DOWN in China by Anonymous Coward · · Score: 5, Informative

    Actually they haven't removed censorship yet. They would be talking with the Chinese government about a way to provide an uncensored search within the law.

    "We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all. We recognize that this may well mean having to shut down Google.cn, and potentially our offices in China."

    A new approach to China

    So, we're still on hold as to if they will remove censorship.

  7. What if IE could be uninstalled? by davet2001 · · Score: 4, Interesting
    Since I never use IE and never intend to, it's a shame that there's no uninstall option in XP.

    Removing IE would save me bandwidth on all the patches and more importantly spare me the forced reboots.

    I'd probably find that a lot of rendered local text would stop working without IE such as help pages, but I usually find google more effective than built in help these days any way.

    1. Re:What if IE could be uninstalled? by BitZtream · · Score: 3, Insightful

      Removing IE is easy, its a wrapper GUI around a browser engine. Delete iexplore.exe, there you deleted IE.

      The rendering engine is in a shared DLL thats used by just about everything now days, even if the app doesn't use the renderer directly, the built in help system is HTML based and uses the shared library for its renderer.

      Its also used by HTML style dialogs, which are basically dialogs that use HTML to define the layout rather than the old style dialog resources.

      This isn't really different from any other modern OS which uses HTML all over the place. I can't think of any modern desktop OS that doesn't have massive dependancies on an HTML renderer.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    2. Re:What if IE could be uninstalled? by WraithCube · · Score: 3, Interesting

      Troll? I know the parent missed the point of the GP that the operating system should not depend on an html rendering engine of a buggy browser, but is quite far from a troll. He brings up a good point. There are a lot of apps that for right or wrong use the IE rendering engine, including plenty of in house applications.

      As far as removing IE goes, iexplorer.exe will get rid of the gui leaving just the engine behind it. However, removing an html rendering engine should not break an operating system. Years ago I mistakenly tried to forcibly remove the rest of the engine from windows xp and ended up with more errors and problems than I could figure out. It breaks windows explorer and if I remember correctly causes internet connection problems since connection properties are configured through IE.

      Though I would have to call into question how much any modern OS depends on an HTML renderer. Correct me if I'm wrong, but I believe both KDE and GNOME would be able to operate with only minor lost functionality without an html rendering engine. I know khelp uses an html library (that oddly is not installed in opensuse by default). GTK+ and QT can both use webkit, but are in no way dependent on it.

  8. Re:Just a thought. by phantomcircuit · · Score: 3, Interesting

    And honestly, so far the chinese have struck me as the competent types.

    The several thousand failed attack attempts in my logs would care to disagree.

  9. Re:Google has BACKED DOWN in China by phantomcircuit · · Score: 4, Informative

    Looks pretty un-censored to me. images:tiananmen square