Microsoft issues Internet Explorer security update
298750
A critical flaw in Microsoft&#39;s Internet Explorer Web browser could allow a hacker to take control of a computer, the world&#39;s largest software maker said Wednesday.
294028
Â Microsoft is investigating reports of a serious security flaw in Internet Explorer (IE), but has not yet seen malicious code that exploits the reported flaw, the company said Thursday.
737024
(InfoWorld) - Microsoft Corp. just can't seem to shake problems with itsÂ MS06-042 update for Internet Explorer. On Tuesday, Microsoft was forced toÂ release its third version of the update because of a new security bug discovered in the update, according to Tony Chor, a group program manager with Microsoft. First released on August 8, the critical patch fixes a handful of problems with the browser, but it has caused headaches for some users. Embarrassingly, it also introduced a security vulnerability into the browser, which was fixed last month. "The original release of MS06-042 introduced a new security vulnerability for IE 6.0 SP1 users which we addressed in a subsequent re-release," he wrote in aÂ Tuesday blog posting. "However... a similar vulnerability was also discovered in IE5.01 on Windows 2000, IE 6.0 SP1 (in a different location), and the original release of Windows Server 2003." Microsoft customers ran into problems with MS06-042 soon after it was released. Web sites that used HTTP (HyperText Transfer Protocol) 1.1 compression to speed up the downloading of images could cause the browser to fail and users of Web-based applications such as PeopleSoft, Siebel, and Sage CRM had problems with the software. Later in August, securityÂ researchers at eEye Digital Security Inc.Â disclosed that Microsoft had introduced a new critical security vulnerability in the update. Two days later Microsoft fixed the eEye bug in the MS06-042 re-release. Apparently this re-release did not address this latest but "similar" vulnerability mentioned by Chor. Microsoft executives could not be reached immediately for comment. Microsoft often re-issues its security updates to fix minor bugs, but the security issue discovered by eEye placed a lot more scrutiny on MS06-042. Ultimately the update proved to be an ordeal for Microsoft's Security Response Center, and for Microsoft customers.
352797
InfoWorld - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update.
315450
Microsoft has warned corporate administrators that it will push a new version of Internet Explorer 7 their way next month, and it has posted guidelines on how to ward off the automatic update if admins want to keep the older IE6 browser on their companies&#39; machines.The IE7 upgrade scheduled to roll out via WSUS (Windows Server Update Services) on Feb. 12 was announced last October, when Microsoft said it would no longer require users to prove they owned a legitimate copy of Windows XP before they were allowed to download the newer browser. Microsoft explained that the move was prompted by security concerns.&quot;Because Microsoft takes its commitment to help protect the entire Windows ecosystem seriously, we&#39;re updating the IE7 installation experience to make it available as broadly as possible to all Windows users,&quot; said Steve Reynolds, an IE program manager, on a Microsoft company blog in early October. &quot;Internet Explorer 7 installation will no longer require Windows Genuine Advantage validation and will be available to all Windows XP users.&quot;The IE7 Installation and Availability Update was immediately made available for manual downloading and was offered to consumers and small-business users via the Windows Update service in the weeks that followed. Beginning Feb. 12, the new IE7 package will be put into the WSUS pipeline as an Update Rollup package.&quot;If you have configured WSUS to &#39;auto-approve&#39; Update Rollup packages, Windows Internet Explorer 7 will be automatically approved for installation after February 12, 2008, and consequently, you may want to take the actions below to manage how and when this update is installed,&quot; Microsoft warned in a support document posted to its site. WSUS&#39;s default setting for Update Rollups is to not autoapprove them.Companies that stuck with IE6 must take action, Microsoft said, or IE7 may be automatically downloaded and installed to their workers&#39; PCs. Specifically, administrators who have set WSUS to automatically approve Update Rollups will need to disable the auto-approval rule before Feb. 12 to prevent IE7 from infiltrating their infrastructure. After that date, they must synchronize the update package with their WSUS server and then switch the autoapproval rule back on.More than one in every three people still relies on IE6, according to data gathered by Web metrics vendor Net Applications. During December 2007, IE6 accounted for 35 percent of the browsers that visited the 40,000-some sites monitored by the company.Microsoft recognized that it needed to protect IE6 from replacement even before it released IE7 in the fall of 2006; prior to the browser&#39;s launch, the company posted a free set of tools administrators could use to block the automatic downloading and installation of the new browser.But it&#39;s unclear what impact, if any, the IE7 rollout via WSUS will have on users who have applied the Blocker Toolkit to keep that browser off their systems. Although asked to expand on the support document -- which didn&#39;t mention the tools -- Microsoft was not able to provide any additional information Tuesday.Computerworld is an InfoWorld affiliate.
280329
InfoWorld - Microsoft has released its monthly set of security patches , fixing problems in Windows, Internet Explorer and in the SSL (Secure Sockets Layer) software used for secure Web browsing.
2243
(InfoWorld) - With attackers finding new ways to exploit aÂ critical flaw in Internet Explorer, Microsoft Corp. has released a patch for the problem, ahead of its next scheduled round of security updates. The patch fixes a critical vulnerability in the way Internet Explorer renders VML (Vector Markup Language) graphics. Hackers had been exploiting the flaw, which also affectsÂ some versions of Outlook, for more than a week, and in recent days malicious activity had been on the upswing. More information on the update, which was released Tuesday, can be foundÂ here. The out-of-cycle release is unusual, but not unprecedented. Microsoft generally releases its security updates on the second Tuesday of every month, giving system administrators a predictable way to set aside time to test the new software. Occasionally, the company will release patches ahead of time if a flaw is being widely exploited by attackers. In January itÂ patched a critical flaw in the Microsoft Windows Metafile (WMF) image-rendering engine after it became a widespread problem. With attack code that works on the latest version of Windows XP now publicly available, the VML bug is shaping up as a very serious concern for administrators, said Ken Dunham, the director of Verisign Inc.'s iDefense Rapid Response Team. VML attacks have now "dwarfed the WMF activity in the same period of time compared to last year," he said. By Tuesday, more than 3,000 Web sites were already infecting users with malware that exploited the VML bug, according to Dunham. One week into the WMF outbreak last January, iDefense saw about 600 sites exploiting the problem. Security experts also warn that there are many variants of the VML malware, some of which may be missed by security software. Researchers at iDefense are now looking at a dozen possible variations of the VML exploit code and have confirmed the existence of seven variants, Dunham said. "With WMF there wasn't nearly as much modification. We see a lot of different permutations and obfuscation techniques being utilize with VML attacks." AÂ group of security researchers released a patch for the VML flaw late last week, independent of Microsoft, but criminals have even found a way to exploit the fix. In the past few days they have been circulating phoney e-mails, claiming to be a patch for the VML problem. If downloaded, this fake patch actually installs malicious software on the victim's system, Dunham said. Microsoft's next regularly scheduled security updates will be released Oct. 10. Â ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
513312
Microsoft plans to issue two security updates for its Windows operating system products next Tuesday as part of its regular software patch cycle.The updates were pre-announced Thursday morning on Microsoft&#39;s Web site in order to give IT staffers a sense of how busy they will be next week installing the patches.One of the updates is considered critical for Windows Vista and XP users because the flaw it fixes could be used by attackers to install unauthorized software on a victim&#39;s computer. This update is rated important for Windows Server 2003 users and considered moderate for Windows 2000 users.The second update, rated important for all Windows users, could allow an attacker to run software with a higher level of privilege on a system than would normally be allowed.Microsoft did not provide any technical details on the updates.With just two updates scheduled, January will be a light month by Microsoft&#39;s standards. In 2007 the company shipped 69 software updates, an average of just under six per month.
425846
Microsoft's monthly set of security patches fix problems in Windows, Internet Explorer and the SSL software used for secure Web browsing.
210968
com December 17, 2004, 11:40 AM PT. Microsoft is investigating reports of a new Internet Explorer flaw that puts people with the most secure version of Windows at risk of phishing attacks.
209227
Security researchers are warning of another pair of vulnerabilities in Microsoft Corp.&#39;s Internet Explorer browser affecting users on fully patched Windows XP Service Pack 2 systems.
321788
Microsoft on Tuesday issued a patch for an earlier discovered flaw in Visual Studio 2005, while yet another cumulative patch for Internet Explorer was released, as well as one for a vulnerability within the Windows Media Format.
741417
Microsoft releases critical Explorer patch VNUNet.com
260192
Mozilla will patch a security bug in Firefox that could be attacked in Internet Explorer.
609685
Microsoft today released an out-of-cycle security bulletin and patch for a critical hole in Internet Explorer that is already being widely exploited by attackers.
507974
Microsoft Corp. released four critical patches Tuesday to plug security holes in several versions of its Windows operating system, Internet Explorer Web browser and other programs.
235692
Microsoft's recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.