Just for you, Latch: Enhanced Mitigation Experience Toolkit V2.0 REF: http://blogs.technet.com/b/srd/archive/2010/09/02/enhanced-mitigation-experience-toolkit-emet-v2-0-0.aspx
Direct Download: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04
When a process, against every good and known practice is allowed to violate the rules (as some Adobe products do), there is EMET. It is extremely easy to enable profiles and add specific applications, like Acrod32.exe and from then on ignore zero day defects in Adobe's Acrobat Reader.
Still do run as I have suggested - as a standard users on Vista/7 x64 with UAC left on and elevated to its highest in Win7 and do use IE 8/9 with Protected Mode on. Then use Microsoft Security Essentials, because it talks to the Windows Filtration Platform and File System Filters.
If/when an exploit for a third party app is out there and like Adobe, is able to run around the UIPI broker and skirt protected mode (FLASH... ptew ptew...) use EMET and you can forget the worries. It creates no drag on a system at all.
Finally, if you're running IE 9 BETA, uninstall FLASH and use the new x64 bit versions in BETA parallel to it - these 32 and 64 bit versions (install both of them) are brokered as they should be. Available here, http://labs.adobe.com/downloads/flashplayer10.html
Latch, have you patched Ubuntu 10.x? It took 45 minutes today and yes, I use APP Armor, which by the way, EMET is much like - only it works and doesn't cause the application to crash.
|