Critical IE 7 exploit making the rounds
Microsoft issued a critical security warning Tuesday that a malicious exploit is making the rounds and attacking vulnerabilities in Internet Explorer 7.
The risk is believed to be widespread, given that IE 7 is the latest version of Microsoft's browser and is bundled with XP service pack 3 and also Vista, said Dave Marcus, director of security research and communications for McAfee's Avert Labs.
The AZN Trojan, which has been making the rounds since the first week of December, has the potential of infecting users' system with a Trojan horse, or "downloaders" that can download other forms of malware onto a user's system.
Microsoft announced it will release a security patch Wednesday via its automatic update system to patch users computers.
Users can potentially get infected two ways, Marcus said. One is to visit a malicious Web site that already has the malware installed on the site, or visit a legitimate site, in which the attacker has inserted the malicious script to run in the background, leaving visitors unaware their systems have been compromised.
"A lot of Web sites are pushing out this exploit," Marcus noted. Some of the infected sites include Web sites that offer free wallpaper for mobile phones to sites that feature property to product-related sites.
Microsoft is encouraging users to update their systems once the patch is released Wednesday at 10 a.m. PDT.
Dawn Kawamoto covers enterprise security and financial news relating to technology for CNET News. E-mail Dawn. 
The only thing that 'continues to suck' is your trolling attempt, it would appear.
"You honestly don;t know anything about security, do you? "
Well, to be honest, based purely on your comments made both here and on Slashdot, neither do you. What are your qualifications?
I run three sites in North America with (so far, not counting workstations) 120+ servers, four Cisco 6509's (plus various switches, routers, an ASA rig, and an MPLS network ...and growing). I showed you mine - now show me yours (I know, I know - help desk, right?)
The point is simple: counting flaws is a sign of pure ignorance WRT to security. The vast majority of OSX and Linux flaws would (at best) require local access to the box (where all bets are off anyway no matter what operating system we're talking about). OTOH, an alarming (and much higher) percentage of Windows flaws allow remote exploitation... like the one in the article up there.
Do you wish to claim differently? If so, please provide supporting evidence for your claims.
/P
"I run three sites in North America with (so far, not counting workstations) 120+ servers, four Cisco 6509's (plus various switches, routers, an ASA rig, and an MPLS network ...and growing). I showed you mine - now show me yours (I know, I know - help desk, right?)"
Okay, this appears to be Job Description 3372-A. Not be confused with the multiple other job descriptions you claim as well. :)
You last claimed to be working for a small startup company with 10 employees. I'm impressed that it has grown from a startup with 10 people to such a huge megacorporation as you have claimed. Way to go! Is this the same company that has the 10,000 plus workstations that you are responsible for converting from Windows to Linux desktops, or the one where you ran a publishing empire across several nations with billions in sales (which turned out to be a small children's book publisher in Oregon and nothing like his claim).
To verify your claim, it would be appreciated if you gave the name of the company. Otherwise it's just a story- one of many you tell. I'm not saying you're lying again, I'm just saying you have a history of telling stories and fabricating different backgrounds to suit the subject at the moment. If you could clarify this once and for all with a name of the company for verification, that would be awesome. Your qualifications don't really have anything to do with IT security, I note. As a screw driver tech, I support 35,000+ deskstops, more than 10,000 servers, and multiple data centers across the planet both remotely and in person. For sheer numbers of systems and diversity of those systems, I have you beaten down into the dirt so far that you could probably speak Chinese to the locals. Citing numbers of systems is meaningless, is my point. I support and work on far more machines than you do and I'm not an IT Security Professional- and unless you can cite your background training, education, industry certifications, and current employer that we can verify this with, then... well, your story is just that. A story.
"The point is simple: counting flaws is a sign of pure ignorance WRT to security. "
And yet you do this very thing in every post that you make when comparing the number of flaws in Windows versus OS X. Are you going back on your own word? Curious that you would change your story again here. Doesn't say much for being consistent or reliable in your comments there, does it?
If you don't want people to cite your own comments as an example, perhaps you may want to think twice about making them.
BTW, when you said: "And yet you do this very thing in every post that you make when comparing the number of flaws in Windows versus OS X. " , you lied... again. When I look at patch reports, I categorize them by severity and ease-of-exploitation. You sort of forgot that part. ;)
/P
So, no web browser exploits in there turning Apples into zombies, then?
Go figure.
Well, the difference is simple: Microsoft has yet to put out a patch for this particular (and actively exploited) security hole.
"Well, the difference is simple: Microsoft has yet to put out a patch for this particular (and actively exploited) security hole."
And it's being released tomorrow. It's even right there in the article. Did you miss it? The patch has been in internal testing for nearly two weeks. You wouldn't be as ignorant and stupid as to recommend an OEM release a product without first testing it, would you? I mean really, it has been tested and will be released tomorrow.
Will you be retracting your statement tomorrow or continue to look foolish? Your call.
...meanwhile the flaw is being actively exploited.
This has less to do with MSFT's patching cycle than it does with the fact that such a flaw exists and can be exploited remotely in the first place. Defend your employer all you want, but seriously - what other browser + OS combination has ever had this kind of ease-of-penetration by script kiddies in history?
/P
Let's see- what is the most popular browser and OS out there in use today? Which is the most exploited?
It's pretty simple math that even a self proclaimed IT Security Professioanl such as you can figure out, I'm sure.
But good job at trying to change the subject instead of addressing the issue. When faced with an answer you don't like, you're good at trying to avoid it. You might consider politics for a profession. You'd be good at it.
The Penguinisto Party! Could be popular, you know.
Penguinisto:
Let's see- what is the most popular browser and OS out there in use today? Which is the most exploited?
----------------------------------------------------------------------------
Come on Dan, I thought you were smarter than that. Some facts to refute your "market share" argument - Mac OS 9 had viruses written for it and released "in the wild". OS X has not. OS X has been vastly more popular than OS 9.
Get it, or do we need to spell it out more carefully?
It's amazing how often winblows apologists pull that tired and repeatedly debunked argument out. Don't you have anything else to fabricate? Tell us again how "secure" winblows is.
Methinks Microsoft's new marketing strategy is to hire a bunch of blog commenters to attack their competitors, based on what I've been seeing lately.
Meanwhile I'll just continue counseling all the folks I know who are stuck with Windows, to just use Firefox, and only open IE for Windows Update.
/P
So... you gonna answer those questions up there, or just slink away from them, tail betwixt legs?
What is your financial incentive for these postings? Nobody has that amount of dedication (or lack of a personal life) as to spend nearly every waking moment waiting to pounce on any news or information about Microsoft in order to spread your hatred to all. I would hate to think you're doing this for no money- that would indicate your really don't have a life.
Just curious behind your motives. I'm curious to see yoru answer to this. What you answer will say a lot about you.
BTW, Dan, no bigotry here, and your claim is a slap at those who suffer actual bigotry. Please stop using inappropriate and overblown descriptions.
Also, you assume too much - I merely post here for fun.
drummer
Most every browser is free these days anyways - why are you expecting them to work perfectly?
Responsibility.
Apple does this as well. Does this mean that Apple is as guilty as Microsoft for having the nerve to release OS and product patches? If you are quick to yell at Microsoft for releasing a patch, then you must do the same for Apple or have to defend your doublestandard.
Curious.
It is not uncommon for MS to take years to release a patch.
The only thing that is curious is why MS pays you money when you don't have the first clue about computers and software.
If you have a clean install of XP and install SP3, it will still be IE6.
similar-
Mozilla Firefox, The Newest Threat To Internet Explorer -
http://www.techreviews4u.com/?p=2277
http://blog.threatfire.com/2008/12/internet-explorer-70-0day.html
I think that we are seeing limits of Msoft's patching efforts -- they just seem overloaded right now. This hole should have been patched last week. But the huge list of patches they already covered has kept them busy.
There are good reasons why this 0day was going for $15,000. Patching it has a clear urgency.
This one has been hot for over a week and it will be distributed for months to come -- the same sites using this ie7 0day are also reliably attacking the two year old MS06-014 vulnerability as well.
Btw, Firefox and Opera selectively are being attacked by these sites as well. Just not 0day. Chrome predictably will be next on the list, as it gains traction.
In every forum space I have seen your posts you are bashing the comment ahead of you and every subsequent reply, no matter whether it concisely corrects you with the facts.
You have so many conflicting posts that demonstrate that you are just a comment troll.
I would suggest to ALL readers of forums and Article feedback to just ignore him and his comments, just don't answer him as it is as productive as talking to a wall. Facts don't mean anything to him; it is all about him trying to build up his ego.
Peguinisto I suggest the following applies to your posts and you should not argue for the sake of argument.
"It's better to not say anything at all and appear ignorant than to open your mouth (keyboard in these instances) and remove all doubt".
You truly have an psychological insecurity and for allegedly having such an array of different jobs and responsibilities (depending on the post) it seems that you have a lot of empty time on your hands.
This is the only comment I will post so show everybody how "Intelligent" you are and bash this post to pieces.
Screaming for folks to ignore me doesn't refute the facts and logic that I present.
The truth can get uncomfortable for you folks sometimes... I understand that. But maybe you should be screaming for MSFT to remedy things so that the truth isn;t as uncomfortable for you?
So far, we are. Prove otherwise, please. ;)
- by kai7070 December 18, 2008 6:16 PM PST
- Just saw a funny video of what happens to people w/o proper protection... even SANTA!
- Reply to this comment
-
(49 Comments)http://www.viddler.com/explore/SantaFraud1/videos/2/