Text 13029, 65 rader
Skriven 2006-09-22 23:51:40 av Geo (1:379/45)
Ärende: Re: Security pros provide interim IE patch
==================================================
From: "Geo" <georger@nls.net>

Or you could just disable scripting..

Geo.

"/m" <mike@barkto.com> wrote in message
news:nlr8h25moh6pavriep49lchrh84s4klr1b@4ax.com...
>
>
>
> http://news.com.com/2100-1002_3-6118672.html?tag=nefd.top
>
> ===
> A group of security professionals has created a third-party fix for a
> recently discovered Internet Explorer flaw that's increasingly being
> used in cyberattacks.
>
> The group, which calls itself the Zeroday Emergency Response Team, or
> ZERT, created the patch so IE users can protect themselves while
> Microsoft works on an official fix
>
> "Certain members of the group feel that the risk associated with this
> vulnerability is so great that they can't wait for a patch. Some users
> might agree with that and apply this patch," ZERT spokesman Randy Abrams
> said Friday. Abrams is director of technical education at security
> company ESET and volunteers with ZERT.
>
> The flaw lies in the way IE 6 handles certain graphics. Malicious
> software can be loaded, unbeknownst to the user, onto a vulnerable
> Windows PC when the user clicks on a malicious link on a Web site or an
> e-mail message. Word of the vulnerability came earlier this week, when
> the weakness already was being exploited in cyberattacks.
>
> "Attacks have ramped up significantly in the past 24 hours," said Ken
> Dunham, director of the rapid response team at VeriSign's iDefense. In
> many cases, the attacks install spyware, adware and remote control
> software on victims' PCs.
>
> In at least one case, cybercriminals broke into a Web hosting company
> and redirected 500 Internet domains to point to a malicious site that
> exploits this latest flaw, Dunham said. "So you're just surfing the Web,
> and all of a sudden, you are redirected to a malicious Web site," he
> said.
>
> Attacks that exploit the flaw via e-mail likely will surface soon, he
> added.
>
> While Microsoft is aware of the attacks, it said it does not recommend
> using the third-party fix. "As a best practice, customers should obtain
> security updates and guidance from the original software vendor," a
> Microsoft representative said in a statement....
> ===
>
>
> While I do agree with Microsoft's assertion on third-party patches, the
> assertion does require a certain level of responsibility on the par tof
> the software vendor.  A level of responsibility that Microsoft has
> proven that it lacks.
>
>
> /m

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)