Text 100 - IBM spinners who never say a word....
|
|
|
Microsoft knew about IE6 flaw for months
MICROSOFT WAS MADE AWARE of the zero-day IE6 flaw five months before it released the 'emergency' out-of-band ms10-002 patch to finally fix the problem yesterday.
The release was hurriedly cobbled together to patch the hole in Internet Explorer that was thought to have given Chinese hackers, possibly working for China's government, access to Google's internal systems and human rights activists' Gmail accounts.
The Vole acknowledged that it had known about the flaw when Meron Sellen, a white-hat hacker employed as a security researcher by Israeli firm BugSec, alerted Microsoft to the issue back in September last year.
Jerry Bryant, senior program manager at Microsoft Security Response Center posted a blog update last night, confirming the story:
"As part of our investigation, we also determined that the vulnerability was the same as a vulnerability responsibly reported to us and confirmed in early September," he admitted.
Microsoft had initially planned to release a cumulative IE patch as a part of its standard security patch cycle.
It claims that its standard procedure is to have a six months quality assurance patch cycle so, despite the fact that Microsoft was made aware of the flaw by Sellen, it's making the excuse that it was not unusual that it didn't give punters a security update.
However, wall-to-wall coverage of the Chinese Google hack greatly expedited its early release.
If you want to see the Vole's small print vote of acknowledgement to Meron Sellen for reporting the HTML Object Memory Corruption Vulnerability (CVE-2010-0249), have a look here. µ
Share this:
Share
Surely the NSA is in need of your account information. They can siphon out your substantial balance to fund their ventures. At least your 'safe' from such devious deeds.
Now you see why I use Linux or even OS X for online transactions. I have not trusted the NSA co authored Swiss Cheese OS developer known as Microsoft for many years now.
Just can't let you have the last word when you skipped over the first paragraph in the link you provide.
"Researchers have created attack code that exploits a zero-day vulnerability in Internet Explorer 7 (IE7) as well as in the newest IE8 -- even when Microsoft's recommended defensive measure is turned on."
"Microsoft, however, continues to urge users to upgrade from the eight-year-old IE6 - the only version yet successfully attacked in the wild - to the newer IE7 or IE8."
IE7 + XP - vunerable
IE8 + XP - vunerable
IE7 + Vista - vunerable
None of the above have actually been exploited though.
IE on Vista - Not vulnerable
IE7 or IE8 on Win 7 - Not vulnernable
So it seems they are some advantages to staying less than 6 or so years out of date
@ashflynn & Huxley:
Your comments about old decrepit software would be true if the flaw only existed in IE 6 & older. But it affects ALL versions of IE, despite whatever M$ is yakking on about IE 8 being safer.
Quote from Microsoft's bulletin: "This security update is rated Critical for all supported releases of Internet Explorer: Internet Explorer 5.01, Internet Explorer 6, Internet Explorer 6 Service Pack 1, Internet Explorer 7, and Internet Explorer 8 (except Internet Explorer 6 for supported editions of Windows Server 2003)."
On the other hand, the original bent of the Inq article about MS software being built like a house of cards on a stinking pile of crud and problems generally ignored until it gets wall to wall coverage in the press is still spot on.
You imply that new is always better, when in fact what goes on is erosion of basic values. There's been no increase of *function* in computer software for more than a decade, just more eye candy.
Anyway, this flaw is in IE8, so new didn't help. And if you think that Win 7 is significantly different from XP, well, you didn't read about when Bill made them throw out all the new code and go back to the old.
This hoo ha is ridiculous.
It's like complaining that your ten year old car isnlt as reliable or safe as your brand new one.
Computers and software are all about constant improvement if your either too stupid or stubborn to realise that things need to be updated to keep up with the modern world then perhaps you should consider becoming Amish.
Whilst it may be easy to blame "evil" m$ for this, could we not perhaps blame all the muppets using decade old software?
And the Inquirer isn't exactly helping us to move away from lagacy browsers.
Posting comments doesnt work in Opera
But they don't worry about them until publicized, one way or another.
I've yet to reach final opinion on the google-China flap, but be interesting if an IE flaw literally changes history, huh?