Tag Archives: vulnerability

Internet Explorer security flaw

Leave a reply

Microsoft has issued a ‘critical’ security alert that affects 900million people using its Internet Explorer web browser.

The computer giant warned of a newly-discovered flaw in Windows that could be exploited by hackers to steal personal details or take over computers.

The glitch is so severe it potentially affects every user of Internet Explorer.

Firefox, Google Chrome and Safari browsers are all unaffected by the threat because, unlike Internet Explorer, they don’t support MHTML files, where the problem lies.

The loophole only seems to affect the way Internet Explorer handles some web pages.

Microsoft just said that the bug is inside Windows, presumably because they don’t want users to migrate to other browsers.

Internet Explorer 9

Internet Explorer 9

This means it affects all versions of the operating system currently supported including Windows XP (SP3), Windows Vista, Windows 7, Windows Server 2003 and Windows Server 2008 (R2).

The company has so far been unable to remove the bug itself and has issued a ‘fix it’ security patch to block any attempts to use it.

All Windows users, particularly those who use Internet Explorer, are being urged to download the patch as the company’s security team work on a way to permanently fix the problem.

The company has described the flaw as a serious threat, although no hackers are thought to have yet exploited the vulnerability.


Microsoft spokeswoman Angela Gunn announced the flaw in a security advisory published online on Friday.

She said: ‘An attacker could construct an HTML link designed to trigger a malicious script and somehow convince the targeted user to click it.

‘When the user clicked that link, the malicious script would run on the user’s computer for the rest of the current Internet Explorer session.

‘Such a script might collect user information (e.g. email), spoof content displayed in the browser, or otherwise interfere with the user’s experience.’

Microsoft issues its biggest-ever security fix

Leave a reply

microsoft_logo

* Microsoft addresses record 49 flaws in its software

* Affects Windows, Internet Explorer, Office

* Fixes vulnerability exploited by Stuxnet virus (Adds details on Stuxnet virus, comments from researcher)

Microsoft Corp (MSFT.O) issued its biggest-ever security fix on Tuesday, including repairs to its ubiquitous Windows operating system and Internet browser for flaws that could let hackers take control of a PC.

The new patches aim to fix a number of vulnerabilities including the notorious Stuxnet virus that attacked an Iranian nuclear power plant and other industrial control systems around the world.

Microsoft said four of the new patches — software updates that write over glitches — were of the highest priority and should be deployed immediately to protect users from potential criminal attacks on the Windows operating systems.

Microsoft said it also repaired other less serious security weaknesses in Windows, along with security problems in its widely used Office software for PCs and Microsoft Server software for business computers.


Microsoft released 16 security patches to address 49 problems in its products, many of which were discovered by outside researchers who seek out such vulnerabilities to win cash bounties as well as notoriety for their technical prowess.

“This is a huge jump,” said Amol Sarwate, a research manager with computer security provider Qualys Inc. “I think the reason for it is that more and more people are out there looking for vulnerabilities.”

The geeks who report such vulnerabilities to software makers are known as “white hat” hackers. Sarwate warned that there are also plenty of “black hats,” or criminal hackers who look for vulnerabilities in software that they can exploit to launch attacks on computer systems.

Indeed, the world’s biggest software maker said that the patches released on Tuesday include software to fix a vulnerability exploited by the Stuxnet virus — a malicious program that attacks PCs used to run power plants and other infrastructure running Siemens (SIEGn.DE) industrial control systems.

The virus, which infected computers at Iran’s Bushehr nuclear power plant, was discovered over the summer. Security research Symantec said that it detected the highest concentration of the virus on computer systems in Iran, though it was also spotted in Indonesia, India, the United States, Australia, Britain, Malaysia and Pakistan.

So far Microsoft has patched three of the four vulnerabilities exploited by Stuxnet’s unknown creators.

The total of 49 vulnerabilities exceeds the previous record of 34, which was set in October 2009 and matched in June and August of this year.

The constant patching of PCs is a time-consuming process for corporate users, who need to test the fixes before they deploy them to make sure they do not cause machines to crash because of compatibility problems with existing software.