Microsoft ActiveX hole unofficially patched

MICROSOFT last week published a security advisory about a flaw in its ActiveX doobrey and said it would produce a patch by October 10th.

The vulnerability afflicts Internet Explorer 6 in all its Windows flavours and could allow attackers to take control of a system if a user is lured to a malicious website.

Bored of waiting for Vole to pull its paw out, spods at the Zeroday Emergency Response Team and security vendor Determina released unofficial patches for the flaw.

Zert is a collective of security researchers and programmers. The group says it plans to issue unofficial security updates when vulnerabilities surface that pose a serious risk to the public and/or the infrastructure of the Internet.

Its mates at Determina develop intrusion-detection software. The pair say their patch works on Windows 2000, XP and 2003 systems.

Microsoft doesn't like users applying unofficial patches and says they are likely not to have been tested sufficiently. And it makes them look bad. µ

L'INQ
ZERT