Check out AT&T's FREE camera phones
September 22, 2006 1:58 PM PDT
Security pros provide interim IE patch
- Related Stories
-
Porn sites exploit new IE flaw
September 19, 2006 -
Second unofficial fix plugs IE hole
March 28, 2006 -
Another IE bug hits Microsoft
March 21, 2006 -
Microsoft pushes out Windows patch ahead of time
January 5, 2006 -
Beating Microsoft to the punch
January 4, 2006 -
Wait for Windows patch opens attack window
January 3, 2006 -
Windows flaw spawns dozens of attacks
January 3, 2006
The group, which calls itself the
"Certain members of the group feel that the risk associated with this vulnerability is so great that they can't wait for a patch. Some users might agree with that and apply this patch," ZERT spokesman Randy Abrams said Friday. Abrams is director of technical education at security company ESET and volunteers with ZERT.
The flaw lies in the
"Attacks have ramped up significantly in the past 24 hours," said Ken Dunham, director of the rapid response team at VeriSign's iDefense. In many cases, the attacks install spyware, adware and remote control software on victims' PCs.
In at least one case, cybercriminals broke into a Web hosting company and redirected 500 Internet domains to point to a malicious site that exploits this latest flaw, Dunham said. "So you're just surfing the Web, and all of a sudden, you are redirected to a malicious Web site," he said.
Attacks that exploit the flaw via e-mail likely will surface soon, he added.
While Microsoft is aware of the attacks, it said it does not recommend using the third-party fix. "As a best practice, customers should obtain security updates and guidance from the original software vendor," a Microsoft representative said in a statement.
This is the third time this year somebody has beaten Microsoft to the punch with a security fix. In January, an
ZERT is made up of
Risk of third-party fixes
A word of caution is warranted when it comes to third-party fixes, ZERT noted. "There is a risk associated with a third-party patch because it hasn't gone through the extensive testing that Microsoft puts its patches through," Abrams said. ZERT does provide the source code of its fix, allowing people to validate what it does.
On its Web site, ZERT stresses that its fix has no warranties. "While ZERT tests these patches, they are not official patches with vendor support and are provided as-is with no guarantee as to fitness for your particular environment. Use them at your own risk or wait for a vendor-supported patch," the group stated. The ZERT fix will be removed from the group's site once Microsoft has issued its update, the group said.
ZERT's patch may work well for some individual users or smaller organizations, iDefense's Dunham said. "Most small businesses are agile, but for larger organizations, applying a patch is a bigger hassle. A third-party patch introduces a wide variety of concerns and cost measures, and those can't be ignored," he said.
In addition to compatibility problems, third-party fixes could introduce security vulnerabilities, Dunham said. Microsoft provides several workarounds that do not require the third-party patch on its Web site. Dunham recommends using a workaround, but also said he expects
See more CNET content tagged:
patch,
cyberattack,
fix,
iDefense,
patch management
BTW - according to http://isc.sans.org, it ain't just porn sites getting smacked with this...
Ah well - maybe all the astroturfers are busy trying to reload Windows onto the freshly busted machines?
( as /me goes surfing on in Firefox on Linux... )
/P
For any site you really want scripting to work, add it to intranet zone.
I used IE for 8 years with this practice and never had a problem. I viewed all sorts of sites and never had to worry.
How many weeks is that?
If this was a problem in Firefox it would have been fixed by now.
http://www.theage.com.au/news/Technology/HPs-ethics-chief-pointed-investigator-toward-directors-suspectedof-leaking-email-shows/2006/09/23/1158431932837.html
#1. Security Pros are capable of coming out with a patch quicker than Microsoft proving that Microsoft is DEFINATELY NOT A SECURITY PRO!!!
#2. Microsoft feels that they can postpone their patch until their regularly released Oct 10th patching time-frame when the rest of the security world follows the guidelines of 24-hours to fix Critical flaws and 72-hours to fix non-critical flaws... not like Microsoft whom feels that Critical flaws can be delayed at least 21 days!
#3. That IE is not worth the disk space it resides on... and at todays disk space prices... that ain't much at all.
#4. If nobody used IE... such a flaw wouldn't mean a hill of beans!!!
#5. Microsoft's stance towards stronger security doesn't mean a hill of beans either.
#6. If you want to be hacked over and over and over again... continue using IE.
Walt
- Microsoft's Workaround
-
by wbenton
September 24, 2006 9:18 AM PDT
- One of Microsoft's workarounds says to turn off Active-X.
-
Reply to this comment
-
-
See all 22 Comments >>But if you turn off Active-X, you won't be able to automatically update their up and coming patch when ever it is due. (* LOL *)
Seems like Microsoft is walking all over their own two feet on this one. (* GRIN *)
At least the Security Pros are on their toes!!!
Walt