| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Seven Microsoft patches we want today (but won't get) | |
|
||
| Time: 01:03 EST/06:03 GMT | News Source: News.com | Posted By: Kenneth van Surksum | ||
|
This month Microsoft did not release any patches within its March 2007 security bulletin, though it did update its Malicious Software Removal Tool. Where we'd ordinarily call your attention to important patches from Microsoft, we thought we'd highlight a few important open vulnerabilities. Four are of high-level concern, two of medium concern and one of low concern. Four flaws affect Internet Explorer, one affects Windows and two affect Office. The oldest flaw here dates back to July 2006. In case you missed any previous Microsoft security patches for Windows and Office software, all are available via Microsoft Update. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 333 Last | Next |
The time now is
12:02:37 PM
ET.
Any comment problems? E-mail us |
| #1 By 32132 (64.180.219.241) at 3/14/2007 1:54:53 AM |
|
Is Latch writing for CNET now?
Patch 1 - "CVE-2007-1091: High concern " Clearly the story is dishonest and claims a crash could occur, while security sites Secunia and FSIRT do not mention "crash" or "remote access" In fact, it is Firefox that crashes with the OnUnload security hole: http://securitytracker.com/alerts/2007/Feb/1017701.html From the linked Story: "Titled "Internet Explorer onUnload flaw (1091)," this flaw affects users of Internet Explorer, version 7 and earlier, and dates from February 27. Successful exploitation could lead to a denial of service (crash) and can allow remote access." NOTE: the "crash" and "allow remote access" are not mentioned on any security sites: Fsirt: "Low Risk" "A weakness has been identified in Microsoft Internet Explorer, which could be exploited by malicious websites to conduct spoofing or phishing attacks. This issue is due to an error when handling certain "onunload" events, which could be exploited by attackers to spoof the displayed address bar by tricking a user into entering a trusted URL manually in the address bar while visiting a malicious web page." Secunia: "Secunia Research has discovered a vulnerability in Internet Explorer, which can be exploited by a malicious website to spoof the address bar. The vulnerability is caused due to an error in Internet Explorer's handling of "onunload" events, enabling a malicious website to abort the loading of a new website. This can be exploited to spoof the address bar if e.g. the user enters a new website manually in the address bar, which is commonly exercised as best practice. The vulnerability is confirmed on a fully patched Windows XP SP2 system running Internet Explorer 7 or Internet Explorer 6. Other versions may also be affected." This post was edited by NotParker on Wednesday, March 14, 2007 at 01:55. |
| #2 By 3653 (68.52.143.149) at 3/14/2007 3:33:02 AM |
|
why WISH for security patches... when you can go to apple and get FOURTY FIVE fresh patches as of yesterday.
--- Apple megapatch plugs 45 security holes The megapatch, also known as Mac OS X 10.4.9, is the seventh Apple security patch release in three months. It deals with vulnerabilities in Apple's own software, as well as third-party components such as Adobe Systems' Flash Player, OpenSSH and MySQL. Sixteen of the vulnerabilities addressed by the update were previously released as part of two high-profile bug-hunting campaigns. Several of the flaws could be exploited to gain full control over a Mac running the vulnerable component, according to Apple's advisory. Other holes are limited and could only be exploited to crash a Mac or used by somebody who already has access to a machine. Eight vulnerabilities are related to the way Mac OS X handles disk images; mounting a malicious image may lead to an error and could provide a means for an attacker to breach a Mac, Apple said. Nine vulnerabilities were released as part of the Month of Apple Bugs in January and seven bugs disclosed in the Month of Kernel Bugs in November. Apple also issued a second update which fixes a security bug in iPhoto that could allow an attacker to craft a malicious "photocast" which, when opened, could compromise a Mac. |
| #3 By 12071 (210.84.51.119) at 3/14/2007 5:03:33 AM |
|
#1 DoS/crash was most likely determined, rightly or wrongly, from here: http://xforce.iss.net/xforce/xfdb/32647
Remote exploitability was most likely determined, rightly or wrongly (probably rightly given that a webpage can cause the exploit), here: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1091 The Firefox bug you mention has been fixed, the IE one has not. Get back into your little hole and wait 200+ days for a fix like a good boy. #2 You really do hate Apple don't you? Isn't the "mega-patch" what Microsoft call a Service Pack with the obvious distinction that Apple release a lot more of them on a more timely basis? (http://docs.info.apple.com/article.html?artnum=304821) Oh and before you tell us all about how XP SP2 was more than just a mega-patch because it included enhancements etc, that hasn't been necessarily true for all of the other Service Packs Microsoft has put out and OS X 10.4.9 does include enhancements as well. But of course Apple doing it is bad whereas Microsoft doing it is the best thing since sliced bread! Note that whilst you're concerned about Apple users who could have been exploited with the attacker having "full control over a Mac", unless of course they patched their system or upgraded to 10.4.9, you are currently (http://research.eeye.com/html/advisories/upcoming/20061024.html) at risk of the very same thing with no patch available whatsoever. |
| #4 By 2960 (24.254.95.224) at 3/14/2007 7:39:34 AM |
|
Well, at least Apple issued a patch :)
TL |
| #5 By 23275 (24.179.4.158) at 3/14/2007 9:20:32 AM |
|
Does anyone want to discuss non-root-level "admin" admin accounts and UAC as implemented in Windows Vista -vs other operating systems and OSX? - and which has the better implementation?
How about firewall defaults in the OSes and how users work opposite them and which methods are better? UDP responses, and the off by default nature in OSX? Anyone? I'd like to get into this with people and perhaps help reveal some truths and shed some light on some subjects about which OS truly is more secure in the only context that matters - the end user who is not an uber-alpha-geek and not supported by an effective IT/MIS department. I mean, there are a lot of guys on Awin that have good instincs about these issues that are approaching the issue from perhaps a less effective perspective - e.g., from what the IT press has to say, or what one "security" company or another has to say [when such companies most often could give half a flip about end user security - they simply have a business model and just as often an agenda]. I'm not talking about a class on how to break a *nix, per se... but I am talking about revealing some real world truth - to support a discussion that exposes the truth and at the same it might help people - regardless of their OS choice - that's really what it comes down to. I'd be willing to bet that all but the die-hard "I hate you for existing Microsoft/America/PC" crowd would come away understanding just how dang good Vista is and just how effectively LUA is supported in Vista - they will also come away understanding just how badly these same things are supported in OSX [currently the only *nix widely enough distributed to really matter within the context of the discussion]. I think it is time to re-focus the entire discussion - from the user out. I think it is time to candidly examine how OSX users, for example, actually run their machines and why. So forget all this "Link Pointing" [like finger pointing, but more ridiculous], let's examine this in the context of the user. I'd bet my reputation as an engineer that if one were to implement all the security recommendations for OSX, or a *nix, as needed to make it as secure as Windows Vista is out of the box, that not only couldn't an OSX/*Nix user actually "use" the machine, they would not wish to - they may seem to be modest adjustments, but the truth is that the balance that Vista has which combines effective end user security with a good experience, would very quickly rise to the top and reveal how well thought out and implemented LUA is in Vista as opposed to all other OSes available to end users. I also submit that any candid engineer or CS expert already is keenly aware of this reality. |
| #6 By 32132 (64.180.219.241) at 3/14/2007 10:14:32 AM |
|
#3 "DoS/crash was most likely determined, rightly or wrongly..."
Wrongly. If you read the references like FSIRT (which I used for my first post) you realize it is Firefox that has the memory corruption/crash problem. Not IE. onUnload was low risk on IE. On Firefox it was remotely executable. Dishonesty is not the way to go on these issues even if it is the preference of Microsoft haters worldwide. This post was edited by NotParker on Wednesday, March 14, 2007 at 10:18. |
| #7 By 32132 (64.180.219.241) at 3/14/2007 10:18:03 AM |
|
#3 "Isn't the "mega-patch" what Microsoft call a Service Pack with the obvious distinction that Apple release a lot more of them ..."
Yes. Apple releases hundreds of security patches more than Microsoft. A Windows Service Pack is an accumulation of all bug fixes + all security patches previously released. While Xp SP2 was unusual by being more like XP R2 with lots of changes to the underly architecture, usually an SP has no new security fixes in it. This post was edited by NotParker on Wednesday, March 14, 2007 at 10:18. |
| #8 By 2960 (24.254.95.224) at 3/14/2007 2:49:25 PM |
|
Notparrker,
I'll tell ya what. Lay that out for us, in an excell spreadsheet, and list all patches released for Tiger, then all patches listed for Windows XP. Then maybe I'll believe it. Oh, and don't forget to mark the critical one's, and the one's that result in zero-day exploits... This post was edited by TechLarry on Wednesday, March 14, 2007 at 14:53. |
| #9 By 2960 (24.254.95.224) at 3/14/2007 2:51:37 PM |
|
btw....
Is it just me, or has Windows update become UNBEARABLY slow these days. Must be all that WGA checking going on... TL |
| #10 By 3653 (68.52.143.149) at 3/14/2007 3:02:38 PM |
|
techlarry - "Well, at least Apple issued a patch :) "
you KNOW i'm gonna throw that comment up in your face a few times in the next few years, you mactard. ;-) |
| #11 By 32132 (142.32.208.234) at 3/14/2007 3:27:27 PM |
|
#8 Counting the Apple ones would take too long.
Here are the ones for the last 2 years: http://www.frsirt.com/english/vendor/229 Half are critical. Most are "multiple". Examples (# = total vulnerabilities in a patch) 49: http://www.frsirt.com/english/advisories/2007/0930 8: http://www.frsirt.com/english/advisories/2007/0825 15:http://www.frsirt.com/english/advisories/2006/4750 12: http://www.frsirt.com/english/advisories/2006/3852 3: http://www.frsirt.com/english/vendor/229 7: http://www.frsirt.com/english/advisories/2006/3577 ... 31: http://www.frsirt.com/english/advisories/2006/1779 etc etc. I'm guess 300 in the last 2 years. Maybe more. Just the critical ones. |
| #12 By 3653 (68.52.143.149) at 3/15/2007 12:06:22 AM |
| [cricket chirp] |
| #13 By 37 (76.210.78.134) at 3/15/2007 7:43:54 AM |
|
Mac roolz. K?
Roscoe P. Coltraine.............yeeeeeeeeeee haaaaaaaaaaaaaaaaa |
| #14 By 12071 (210.84.51.119) at 3/15/2007 8:14:26 AM |
|
#11 Since you're taking the moral high ground here (which is funny in and of itself I must admit), how about you be a little more honest. How many of the patches that you referred to are in fact for applications such as:
- Flash Player - QuickTime - iChat - iSync - MySQL - Web Browser - FTP Server - VPN Server - XCode, development tools and compilers In which case, be sure to add all the vulnerabilities for Windows Media Player, MSN Messenger, ActiveSync, SQL Server, IIS, Internet Explorer, Visual Studio etc. #12 You can tell us all why you hate Apple so much if you like. lketchum has written several essays on the topic in the past! |
| #15 By 37 (76.210.78.134) at 3/15/2007 8:36:49 AM |
| At least it appears that NotParker is backing up his claims with links, which is more than I can say for the others. |
| #16 By 32132 (64.180.219.241) at 3/15/2007 10:35:23 AM |
| #14 Apple would still have, by far, the most vulnerabilities. |
| #17 By 3653 (68.52.143.149) at 3/15/2007 6:06:21 PM |
|
NotParker put up.
And the clan shut up. |
| #18 By 32132 (142.32.208.233) at 3/15/2007 8:00:46 PM |
|
http://blogs.zdnet.com/security/?p=124
"When the controversial Month of Apple Bugs (MOAB) project ended earlier this year, a derisive “that was it?” reaction could be heard coming from the Mac faithful. Outside of a QuickTime code execution exploit (which required user interaction), the majority of the MOAB vulnerabilities released dealt with denial-of-service crashes and privilege escalation bugs, prompting the dismissal of the project as a failed publicity stunt. But, a close look at Apple’s latest batch of bumper patches provides total vindication to LMH and Kevin Finisterre, the two hackers who went against the grain and called attention to serious defects in code coming out of Cupertino. Same goes for the researchers who participated in last November’s MOKB (Month of Kernel Bugs), a sister project that highlighted kernel-level vulnerabilities in various operating systems, including Apple’s flagship Mac OS X. Apple’s 2007 patch count is an eye-opener. Seven updates, 62 vulnerabilities. Yesterday’s bumper Security Update 2007-003 provided fixes for a whopping 45 security bugs affecting Mac OS X users. The biggest takeaway from Apple’s advisories since last November is the patches that address flaws found during the MOKB and MOAB disclosure projects. More importantly, in the brief notes in Apple’s public bulletins, the company is making it clear that many of the MOKB/MOAB flaws were “high risk” issues that could lead to arbitrary code execution attacks. Very serious issues." |
| #19 By 3653 (68.52.143.149) at 3/17/2007 3:54:25 PM |
| another [cricket chirp] moment. Indicative of a NotParker victories. |
|
Write Comment
Return to News |
Displaying 1 through 25 of 333 Last | Next |
The time now is
12:02:37 PM
ET.
Any comment problems? E-mail us |
