[SurfData]

see IE auk on kökimöki, praegu avalikustati turvaauk, mis on KÕIKIDES 32bitistes opsüsteemides, mis on välja lastud viimase 17!!!! aasta jooksul (win 3.1 pole testitud, kõikides muudes peale seda on olemas):

http://www.theregister.co.uk/2010/01/19/microsoft_escalation_bug/

64bit opsüsteemiga seda muret pole.

[tahanteada]

Aga ega "üle võlli" paanitseda ka nende aukudega pole mõtet. Kõike tuleb ikka võtta kaine peaga, mitte minnes kohe "pilvelõhkuja katuselt arvutit alla viskama" .
Või - nagu mingi 20 aastat tagasi soovitati - kui arvutis on viirus, siis tuleb arvuti toitejuhe kirvega läbi raiuda.
-----------------------------------------
Olen praegu huvi pärast jälginud viirusetõrjetootjate käitumist, keegi ei tegele mingi meeleheitliku paanitsemisega.

[masterx]

[ykshuntka]

[SurfData]

[AJ]

Päris nii sama MS ei vedele

Microsoft Promises Early Patch for IE Zero-Day
http://www.pcworld.com/businesscenter/article/187235/microsoft_promises_early_patch_for_ie_zeroday.html

[sander85]

[tahanteada]

sander85: Ja ega siis kasutajad üksi FF-i alla ei tiri - seda tirivad ju selle võrra rohkem alla ka Häkkerid, et siis turvaauke otsida ja selle kaudu FF-i fänne rünnata.

Mul jooksevad korraga arvutis nii IE, FF kui Opera ning SpyBot näitab üsna selgelt, et kõik nad on piisavalt auklikud, ehk siis turvariskidega.

[XeStAiSy]

[AJ]

Spybot S&D ei ole ka minu masinas leidnud midagi peale küpsiste.

[tahanteada]

Täna on igatahes tore vaadata, kuidas selle "IE-aukude müstifitseerimise" varju jäävad muud huvitavad asjad, nagu:
Esiteks: FireFox viskas endal uuenduse üles. Ei ole aega olnud uurida, et kas see uuenduse ülespanek on juhuslik kokkusattumus või mitte.

Teiseks: SpyBot laadis endale KeyLogeri vastased uuendused. Siis võib järeldada, et mingid uued KeyLogerid ja nende kasutamine liigub ringi. Samas jällegi info, mis jäi selle IE-tagumise-teema varju.

[HacaX]

[AJ]

Microsoft patches critical Internet Explorer hole
http://www.hexus.net/content/item.php?item=22047

Spoiler

tsitaat:

Software giant Microsoft has issued an out-of-band security update to patch a highly-publicised security hole in its Internet Explorer browser. The flaw, affecting multiple versions of IE, was recently used in a major cyber attack on Google, in which hackers accessed the Gmail accounts of Chinese civil rights activists. Following the attack, Google threatened to withdraw from the Chinese market, and European governments - including France and Germany - have publicly advised their citizens to avoid using Microsoft's browser. Widespread media attention has resulted in Microsoft issuing an out-of-band update that "addresses several vulnerabilities," some of which "could allow remote code execution if a user views a specially crafted Web page using Internet Explorer". "We’ve released this Cumulative Security Update earlier than originally scheduled based on malicious activities reported on the web," said the company in a statement, prior to admitting that it knew about the security hole "since early September" 2009 and wasn't scheduled to issue a fix until February 2010. The bad publicity comes in a week in which rival browsers - including Opera, Google's Chrome and Mozilla's Firefox - have all announced new reasons for users to switch. Microsoft's IE security update (MS10-002) is available via Windows Update for Internet Explorer versions 5.01, 6, 7, and 8.

[Tbit]

täna installis jahm mini ie critical patch ära win update

[AJ]

Tuleb jah IE uuendus

Spoiler

E.
Microsoft Patches IE Flaw Used in Google Hacking
http://www.tomshardware.co.uk/internet-explorer-patch-google-hack,news-32630.html

[NATAS999]

AJ, mul see W7 eile õhta midagi nagu askeldas ja tahtis restarti saada. äkki oligi see sama lapp?

ahjaa, oli jah miski cumulative security update for IE8 (KB978207).

täna lasi veel MSE'le uued definitsioonid ka peale.

mul kül suht kuiv tunne IE8'ga. kõik toimib nagu vaja ja ei saaks öelda, et kuskil uimane oleks. 12 megane nett ja jookseb küll. igasugused rebased ja kroomid ja ooperid on läbi käidud. ühel ei toimi üks asi, teisel teine ja kolmas on üldse ummamuudu. ise eelistan ikka ühe asja jaoks ühte asja, mitte nii, et mõtlen, et lähen netti, siis mõtlen et vaataks panka ka korra - ai kurat, et ju ei toeta idikaarti, või siis vaataks videot, aga juutuubiga ei saa hakkama.

IE võib olla progejatele peavalu, aga ometi toimivad minul küll kõik asjad ilusti sellega. pigem on probleeme teiste brauseritega, mis kipuvad ühe või teise asja peale nina kirtsutama.

[AJ]

NATAS999, see uuendus tahtis jah restarti.

[Marie]

[markopolo]

[Chaza!]

[AJ]

More holes found in Microsoft's Internet Explorer browser
http://www.hexus.net/content/item.php?item=22104

Spoiler

tsitaat:

U.S.-based research firm Core Security Technologies has discovered further vulnerabilities in Microsoft's Internet Explorer that it claims could allow hackers to remotely access data on a user's PC. The discovery was made just a day after Microsoft launched a patch to fix a critical security hole that resulted in major cyber attacks on companies such as Google. Core Security Technologies, based out of Boston, claims the vulnerability was first discovered some two years ago. Yet, despite two interim patches by Microsoft, the research firm claims it is still possible to exploit the flaw in three or four ways. Jorge Luis Alvarez Medina, a Core Security Technologies consultant who has been working with Microsoft to try and resolve the problem, has stated that the vulnerability will be demonstrated at the Black Hat security conference in Washington on February 2nd. Whether or not Microsoft will release another out-of-band security update to fix the flaw remains unknown, but the software giant has publicly acknowledged the problem. "Microsoft is investigating a responsibly disclosed vulnerability in Internet Explorer. We're currently unaware of any attacks trying to use the vulnerability or of customer impact, and believe customers are at reduced risk due to responsible disclosure. Once we’re done investigating, we will take appropriate action to help protect customers," said the company in a statement. Although the latest vulnerability is said to affect all versions of Internet Explorer, Microsoft recommends that users upgrade to the latest version, Internet Explorer 8 in order to "enable automatic installation of all applicable updates this month and help to make customer systems more secure".

[Tomorrow]

[AJ]

Midagi IE6-e kasutajatele

Google Drops IE 6 Support After Exploit, Leaves Fifth of Customers in the Dark
http://www.dailytech.com/Google+Drops+IE+6+Support+After+Exploit+Leaves+Fifth+of+Customers+in+the+Dark/article17580.htm

[XeStAiSy]

Mõned päevad tagasi sattusin seda lugema. Fix tuleb järgminenädal.

[HacaX]

[AJ]

Veebruari Win-i uuendus peaks selle vea ära parandama

Microsoft to patch 17-year-old computer bug
http://news.bbc.co.uk/2/hi/technology/8499859.stm

[sant]

[AJ]

sant, ega enne ei liikuta kui mats käes.

[sant]

No täpselt, alates tänasest olen vist viiruse vaba, enam ei leia midagi, ja kolmandik failidele adjöö.
Samas päris loobuda ie-st ei saa, näiteks symanteci online scan ei tööta firefoxi all

[AJ]

Microsoft Warns Windows XP Users To Avoid F1 Key In Internet Explorer
http://hothardware.com/News/Microsoft-Warns-Windows-XP-Users-To-Avoid-F1-Key-In-Internet-Explorer/

Spoiler

tsitaat:

2010 has not been kind to Microsoft's security team. In under a month's time, we've seen Microsoft address a bug that was supposed to fix an ancient exploit but instead caused more headaches, all while having to encourage consumers not to be duped by a fake security site parading around as something useful. As if those software savvy folks up in Washington didn't have enough on their plates, the company has today issued yet another startling advisory, and this is easily one of the more bizarre ones that we've seen. Microsoft has gone public with an investigation into a "a vulnerability in VBScript that is exposed on supported versions of Microsoft Windows 2000, Windows XP, and Windows Server 2003 through the use of Internet Explorer." This is quite significant because a huge majority of PCs in the world still rely on Windows XP, and many corporate environments haven't upgraded or switched away from IE. To date, Microsoft has yet to find evidence that this exploit could harm Windows 7, Vista or Server 2008 users. The primary problem that we're dealing with here is "remote code execution," and while the company admits that they aren't aware of any attacks that take advantage of the vulnerabilities, they're obviously looking to patch things up before it gets bad. Here's Microsoft's exact explanation of the issue: The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user. On systems running Windows Server 2003, Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate against this issue. Did you catch that? The part about the "F1" key? In a few words, Microsoft is actually advising Windows XP users who rely on IE to not use their F1 key, which is kind of crazy when you think about it. Thankfully, not many people actually rely on the F1 key in day-to-day use, but just imagine the outrage if "F1" were replaced with "A." The public is being told that the problem is being worked on, though there is no time table given as to when we can expect a fix. Just push those F1 urges aside from awhile, and everything should be just fine.

[Betamax]

See F1 on Windowsi all paras pind tagumendis. Tihti vajutan F2 asemel kogemata F1 ja sõltuvalt sellest, kui suur on arvuti koormus, tuleb seda Help & Support Centeri akent päris kaua oodata. Samal ajal tirib muidugi arvuti kenasti kooma

[xecroy]

[Betamax]

Kasutan igapäevaselt. Seega ei saa

[AJ]

Unpatched Internet Explorer exploit hits the Web
http://www.techspot.com/news/38202-unpatched-internet-explorer-exploit-hits-the-web.html

Spoiler

tsitaat:

Israeli security researcher Moshe Ben Abu has published the exploit code of an unpatched Internet Explorer security hole. With the help of a McAfee blog post, Abu pinpointed the vulnerability in about 10 minutes. Microsoft warned on Tuesday that the bug could allow an attacker to take control of a computer, and advised users of IE 6 and 7 to install version 8 as soon as possible. CNET asked Abu how dangerous the vulnerability is, and his response was in line with Microsoft's recommendation of updating to IE8. Abu also noted that the exploit is quite unstable, with about 60% to 70% success rate, and confirmed that it is critical to older builds of IE. Microsoft provided additional workarounds in its advisory for users who can't upgrade to the latest browser version. Although information in McAfee's sped up the process, Abu said he would have found the vulnerability anyway. McAfee said the post in question did not contain enough information to directly lead anyone to the hole, but the firm's future blog posts will undergo "additional sanitization" to avoid giving exploit writers a starting point when hunting for exploit code.