September 26, 2006 1:35 PM PDT
Microsoft rushes out 'critical' fix
Last modified: September 26, 2006 3:40 PM PDT
- Related Stories
-
Microsoft mulls early IE patch release
September 25, 2006 -
Porn sites exploit new IE flaw
September 19, 2006 -
Microsoft pushes out Windows patch ahead of time
January 5, 2006
The company is breaking with its monthly patch cycle to fix a flaw that cybercrooks have been using to attack Windows PCs via Internet Explorer. Malicious software can be loaded, unbeknownst to the user, onto a vulnerable Windows PC when the user clicks on a malicious link on a Web site or in an e-mail message.
"This was an excellent move on the part of Microsoft, and we're pleased to see them respond to the concerns of the security community," Alex Eckelberry, president of anti-spyware toolmaker Sunbelt Software, said in an e-mail interview. Sunbelt had been monitoring attacks that exploit the flaw, which it said have been increasing.
The vulnerability, first reported last week, lies in a Windows component called "vgx.dll." This component is meant to support Vector Markup Language documents in the operating system. VML is used for high-quality vector graphics on the Web and is used for viewing pages in the IE browser that is part of Windows. Microsoft deems the flaw "critical," its highest severity rating.
"An attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML e-mail that could potentially allow remote code execution if a user visited the Web page or viewed the message," Microsoft said in security bulletin MS06-055. E-mail messages that use HTML, or HyperText Markup Language, look like a Web page.
The vulnerability does not apply to IE 7, the upcoming version of IE that is available right now in a pre-release form, Microsoft said.
Microsoft typically releases fixes each second Tuesday of the month, which has become known as Patch Tuesday. The last time the software maker rushed out a fix was in January, when another image-related flaw in IE was being used to compromise Windows PCs through malicious Web sites.
Security experts had pushed Microsoft to rush out a fix for the VML flaw. A group of security professionals even crafted an unofficial fix for the problem, which was released on Friday.
"Exploitation has already eclipsed that of the last out-of-cycle patch," said Ken Dunham, director of the rapid response team at VeriSign's iDefense. "It appears that there were several million domains that were redirecting to malicious VML sites."
Microsoft's security update is being pushed out to Windows users via Automatic Updates and will also be available on Windows Update.
See more CNET content tagged:
Sunbelt Software,
Windows PC,
fix,
flaw,
Microsoft Internet Explorer
> lies in a Windows component called "vgx.dll."
> This component is meant to support Vector
> Markup Language documents in the operating
> system. VML is used for high-quality vector
> graphics on the Web and is used for viewing
> pages in the IE browser that is part of
> Windows.
Creeping featurism. Because Macromedia and Adobe Flash don't do any of that, right? Right.
the core). You want internet security? Avoid using Internet Explorer,
better yet AVOID Microsoft all together..!!!!
Every company gets flaws, Apple included, so it's nice to see the
company that many people use get a quick patch.
&& (nice_neat_day_for_release
|| press_writes_article ))
{
release_fix();
}
else
{
wide_open_vulnerability = 1;
}
thing. Apple releases patches and so does MS.
People shouldn't always have to 'harp' on another person's
computer company if that company is trying to help their own
product for their consumers.
Even though they broke again this time by releasing this Critical patch earlier... it's still FAR TOO LATE by most security concious company's standards!!!
Walt
http://www.stateof-california.com
- Slam Microsoft! (Don't bother reading the story.)
-
by Vegaman_Dan
September 29, 2006 7:38 AM PDT
- Sometimes I wonder why people even bother posting if all they are going to do is complain about Microsoft/Apple/Linux/Jello Pudding is evil and should be destroyed. Do they actually read the story or do they have a macros set to make anti-whatever posts regardless of what the story is about and just rant?
-
Reply to this comment
View
all 2 replies
-
-
See all 27 Comments >>Even when MS does something good like make security patches available, people complain. Since they don't even have to do that much and could leave you all hanging in the wind, I think I wouldn't be complaining so loudly.
It's a case of being damned if you do, damned if you don't.