Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Internet Explorer Microsoft Security Software Upgrades IT

Microsoft Patches "Google Hack" Flaw In IE 142

Posted by timothy from the you-saw-this-coming dept.
An anonymous reader writes "As expected, Microsoft has issued an out-of-band security patch to address a remote code execution hole in Internet Explorer that was used in the recent Chinese attacks disclosed by Google. Ars Technica has all the download links you need."
This discussion has been archived. No new comments can be posted.

Microsoft Patches "Google Hack" Flaw In IE More

Microsoft Patches "Google Hack" Flaw In IE

Comments Filter:

  • Microsot (Score:5, Funny)

    by SimonTheSoundMan ( 1012395 ) on Thursday January 21, 2010 @04:49PM (#30852174)

    Ugh, Microsoft! Get it right.

    • Re: (Score:3, Funny)

      by GrosTuba ( 227941 )

      Almost as craptacualr [penny-arcade.com] as the reserachers [slashdot.org] from the front page, who unfortunately got fixed in the meantime :)

    • Re: (Score:2, Funny)

      by burkmat ( 1016684 )
      Perhaps we should stop bashing MS all the time, after all, where would the anti-virus industry be without them?
      • Presumably catering to whatever OS is no. 1 without them having been in the picture. Windows is not targeted for viruses because it is insecure, but because it has had probably 70%+ of the market share for the last 10-15 years at least (I don't honestly know how long they've been on top. Heck I was born in 1988 and didn't get a computer in the house 'til 1999).

        • Re: (Score:3, Interesting)

          by Canazza ( 1428553 )

          That needs qualifying as #1 in the HOME market. There are many more servers running various brands of Unix and Linux out there than there are running IIS or Apache on a Windows box (though not an insignificant ammount).

          Servers are naturally harder to get viruses or trojans onto them as they're generally not used to surf the web, and the only applications executed on them should be done by a responsible sysadmin - who should know better.

          Windows is targeted as it is the #1 Home and Business OS, and as most pe

          • Re: (Score:2)

            by mpe ( 36238 )
            Windows is targeted as it is the #1 Home and Business OS, and as most people are clueless about how the technology actually works (running with admin privileges, surfing dodgy sites, falling for phishing scams, opening spam emails).

            A factor with the "running with admin privileges" is badly written software where the supported method is to have the user, rather than the program (or even part of the program) only having elevated privileges or change the permissions on whatever the program actually needs acc

    • Re:Microsot (Score:4, Funny)

      by lousyd ( 459028 ) on Thursday January 21, 2010 @05:33PM (#30852998)
      I thought it was a clever, subtle jab at MS. Like, they're sots. Tiny sots.

  • Quick turnaround! (Score:5, Funny)

    by Anonymous Coward on Thursday January 21, 2010 @04:50PM (#30852198)
    This just goes to show that OSS is better because the fixes come out fas...

    oh this was IE?

    Oh...

    I mean... this patch just goes to show the lax security and horrendous coding of IE!

    (In all seriousness, it's actually quite nice to see the hole fixed and tested in such a quick time. I think MS actually deserves kudos for the quick turnaround and out-of-band release)

    • Re: (Score:2)

      by EXTomar ( 78739 )

      The cynic in me wonders iff this wasn't such a visible and highlighted Google highlighted would they bothered to push it sooner or even at all or even to let people know there is a problem. But yes it is good you can hold publicly traded company's feet to the fire by having a few countries denounce your product which is totally unlike OSS!

      • Re:Quick turnaround! (Score:4, Funny)

        by Anonymous Coward on Thursday January 21, 2010 @05:01PM (#30852418)

        The cynic in me wonders iff this wasn't such a visible and highlighted Google highlighted would they bothered to push it sooner or even at all or even to let people know there is a problem

        Could you repeat that? My gibberish-to-english translator is on smoke break, and I'm nowhere near as fluent as he...

    • Re:Quick turnaround! (Score:5, Insightful)

      by UnknowingFool ( 672806 ) on Thursday January 21, 2010 @05:07PM (#30852544)
      No it goes to show how fast MS can release a patch (and out of their normal cycle) when face with a large amount of negative PR. Normal vulnerabilities usually have to wait til Patch Tuesday. But when Google announces that IE was to blame in a large number of attacks, both France and Germany advises their citizens not to use IE for a while, MS better patch it sooner than later.

      • Re:Quick turnaround! (Score:4, Informative)

        by aztracker1 ( 702135 ) on Thursday January 21, 2010 @05:28PM (#30852916) Homepage
        Apparently some of the bugs were reported to MS back in September. So it really wasn't *that* fast.

        • Re:Quick turnaround! (Score:5, Insightful)

          by UnknowingFool ( 672806 ) on Thursday January 21, 2010 @05:33PM (#30852986)
          It only proves my point. MS sat on the bugs for months and only released a patch after public disclosure by Google. How much longer would have they sat on them if it wasn't for the bad PR.

          • Re: (Score:3, Insightful)

            by Dishevel ( 1105119 ) *

            How much longer would have they sat on them if it wasn't for the bad PR.

            Stupid question. Answer is of course "Forever!".

          • Re: (Score:2)

            by Malc ( 1751 )

            You've got to wonder though if Google is using this to deflect attention from a problem at their end.

            • I think the other shoe just dropped is what happened. Google proverbially bent over for China repeatedly, with some bad criticisms to discover that they are being attacked by China. They pushed all the cards out to the table. It's worth noting that other companies were also targets of the attacks in question.

          • Re: (Score:2)

            by mpe ( 36238 )
            MS sat on the bugs for months and only released a patch after public disclosure by Google. How much longer would have they sat on them if it wasn't for the bad PR.

            Was it Google or was it several countries, including to large EU members, putting out the message to avoid using the software. AFAIK national governments doing this kind of thing hasn't happened before.
      • Maybe it just shows how fast you can release a patch when you're not allowed to say "it's still beta" or "you can't complain because you're getting it free".

      • Re: (Score:2)

        by mpe ( 36238 )
        But when Google announces that IE was to blame in a large number of attacks, both France and Germany advises their citizens not to use IE for a while, MS better patch it sooner than later.

        IIRC Australia also put out similar advice. Though it's probably bigger for France and Germany to agree :)

    • Nothing quite like two national governments recommending against using your product to raise the priority of fixing the problem.

      • Re: (Score:3, Insightful)

        by bstone ( 145356 ) *

        >>Nothing quite like two national governments recommending against using your product to raise the priority of fixing the problem

        Nothing like people actually switching browsers in droves because of the warnings to raise the priority of fixing it. Now that they've switched, what are the chances of those lost users switching back?

    • According to the BBC [bbc.co.uk] they've known about it since September. Back to the bashing as usual...

    • Microsoft knew about it last September.

      • They also very likely had no intention of fixing the bug, and no tenative patch. Then, the moment they start getting a boatload of bad PR from Google and a couple governments, they have a patch out extremely fast. So yes, it does prove they could have an amazing turnaround, if they spent the resources for it.

  • WTF! FORCED SHUTDOWN (Score:5, Informative)

    by indi0144 ( 1264518 ) on Thursday January 21, 2010 @04:52PM (#30852236) Journal
    It will force shutdown even if you don't check the box at the end of the installer. How can this be so wrong at so many levels.

    • Re:WTF! FORCED SHUTDOWN (Score:5, Insightful)

      by mrjohnson ( 538567 ) on Thursday January 21, 2010 @04:56PM (#30852302) Homepage
      Rebooting to upgrade a browser is at least five levels of wrong!

      • Re: (Score:1, Informative)

        by Anonymous Coward

        Unless the patch was to the Trident libraries, in which case I can understand. Trident is the rendering engine behind MSIE, and is in use by other programs even if MSIE isn't using it.

        • Rebooting to upgrade a library because you can't replace an in-use file is 15 levels of wrong. :-)

          • Better than the alternative, which is to potentially leave software running with a still vulnerable browser, and a user with a false sense of security because they 'just installed the patch.'

            Allowing libraries to be modified on disk while in use is a solution to the upgrade problem which is simple, elegant, and terribly, terribly wrong.

            • Re: (Score:3, Informative)

              by mpe ( 36238 )
              Better than the alternative, which is to potentially leave software running with a still vulnerable browser, and a user with a false sense of security because they 'just installed the patch.'

              The other alternative is to put up a message saying "These applications/services/etc need to be restarted".

              Allowing libraries to be modified on disk while in use is a solution to the upgrade problem which is simple, elegant, and terribly, terribly wrong.

              If the OS is sufficently "clever" the old version of the libr

            • Bah, on Linux and *every other OS besides Windows* I can upgrade my websever, test the configuration and restart just the process when I'm ready. I often do the upgrade work a few hours beforehand (when I'm awake) and reboot Apache during a slow period (usually late night).

              On Windows you may have to first shutdown the webserver to upgrade, or reboot the entire server, causing a much longer outage than needed.

              Or just look at the jar locking hacks Tomcat has to do because you can't replace an in-use jar. I've

          • Re: (Score:3, Interesting)

            by weicco ( 645927 )

            Uh! I would love to "upgrade" in-use shared library files so that changes are reflected to loaded instances in every running process! My viruswormtrojan would rule the world!

      • You could be one of those people who is stuck using XP SP1, so it won't install to begin with.

        • But, I guess even if they are stuck with XP SP1, they could always just use another browser.

          But, some people just love the feel of Internet Explorer 6. But to the best of my knowledge, there aren't any "I heart IE6" t-shirts available, so perhaps those people are few and far between.

      • Re: (Score:2)

        by dmomo ( 256005 )

        Which, most likely means it's a browser exploit, but the problem is much deeper. And why a browser's code has to go that deep? Beyond me.

    • Wonder if it will take Skype down again [nytimes.com] with it too.

    • Re: (Score:1, Informative)

      by Anonymous Coward

      I tested a server and a desktop (Windows 2008 R2, Windows 7) and neither auto-rebooted from the Windows Update.

      What are you talking about?

      • You're right my forced reboot was on XP SP3 and IE8 via downloaded patch. I installed earlier in w2k SP4 IE6 via win update and it didn't forced shutdown so it's maybe .. random(tm), still, If you unchecked the box IT SHOULD NOT RESTART! thanks good I'm a beaten wife that know this kind of things happens, didn't lose anything unsaved.

        hey Adobe, would you ever port your software to Linux?? : ( Not holding my breath.

        • Re: (Score:2)

          by socsoc ( 1116769 )
          My XP SP3 gave the dialog of restart now or later via Microsoft Update. So I chose later. Odd that directly getting the patch would be different.

    • Shutdown IS the fix (Score:5, Funny)

      by syousef ( 465911 ) on Thursday January 21, 2010 @05:07PM (#30852546) Journal

      It will force shutdown even if you don't check the box at the end of the installer. How can this be so wrong at so many levels.

      You don't get it. Shutting down your computer IS the security fix. If you start it up again, you're back where you started - with Windows and IE.

      • Actually you're correct, it restarted on my Mandriva install :)

        Bus since I'm working in some designs I had to reboot to Windows. The forced shutdown it's more related to the patch you download, windows update does not force shutdown AFAIK.
        • If you use Automatic Updates, and the updates it installs require a reboot, it'll show a 5 minute countdown, after which it'll forcefully reboot. If you happen to not be at the computer when it does, you can say goodbye to any unsaved work you might have had.

          • Re: (Score:1, Insightful)

            by Anonymous Coward

            Why would you walk away from your pc for more than 5 minutes without saving anyhow. Comments like this just make me wanna scream dumbass.

    • Re: (Score:2)

      by Bengie ( 1121981 )

      I use Win7 and it installed then said it was done. No reboot or prompt/question to reboot.

      • Re: (Score:2)

        by Bengie ( 1121981 )

        nvm. There was a different out of band critical update that didn't require a reboot. This one did need a reboot to take effect, but it didn't force it.

  • Just a thought. (Score:2, Interesting)

    by burkmat ( 1016684 )
    Now, if I had that kind of exploit (along with the Windows source code) to play with, and the skills to individually target a specific Google machine, I'd sure as hell make sure to sneak my exploit into the soon-to-appear Microsoft patch site...

    And honestly, so far the chinese have struck me as the competent types.
  • This is a bit off-topic but I have nowhere else to post this. I have attempted to post the reports that Google has backed down in China and re-enabled search result filtering in Google.cn despite of the lack of REAL actions from the Chinese government [slashdot.org] in the last two days, but /. editors keep refusing to put this relevant in the headline. Right, how can we be critical of our new found American hero defending the precious "freedom" and fighting the evil China? How can a hero backing down to the evil China? H

    • Re:Google has BACKED DOWN in China (Score:5, Informative)

      by Anonymous Coward on Thursday January 21, 2010 @05:12PM (#30852626)

      Actually they haven't removed censorship yet. They would be talking with the Chinese government about a way to provide an uncensored search within the law.

      "We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all. We recognize that this may well mean having to shut down Google.cn, and potentially our offices in China."

      A new approach to China [blogspot.com]

      So, we're still on hold as to if they will remove censorship.

      • As mentioned in my post and in /. front page last week, google has suspeneded the filtering after their announcement. Why re-enabled rather quietly? That part I have problem with. If they have stood up, why backed down? (And the Chinese government only made some general stanard statement, no real threat either. Why is that not mentioned in Western media?) all in all, I'm as disappointed by our media as by the CCP's.

        • Re: (Score:1, Informative)

          by Anonymous Coward

          The link in the article [publicaddress.net], even on the day it was posted on slashdot, talked about conflicting reports.

          Current status @ 07:20 NZT, 02:20 Beijing time, 14-01-10: Still conflicting reports coming out. It could be that Google has already lifted its own censorship measures. Or it could be that the censorship measures are still up, but because of the intense interest generated (and click-thrus) on sensitive subjects, small holes in the wall are being publicised and magnified.

          That was probably some over-enthusiasti

    • Hmm, searching for "Tianamen" in images still gives you pictures of the student in front of the tank. Isn't this supposed to be censored as well?!

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Calling China "evil" is childish, naive, narrow-minded, and stupid.

      • Re: (Score:3, Insightful)

        by drinkypoo ( 153816 )

        Calling China "evil" is childish, naive, narrow-minded, and stupid.

        As long as China is killing people for cheating on their taxes and harvesting their organs, then selling them on the world market, then they are evil. As long as they are imprisoning Christians for their religious beliefs, gang-raping them and sending them to work camps to make plastic gewgaws (like christmas lights) for sale in the US, they are evil. And as long as we buy them, we are also evil.

        Why, oh why, have you not logged in? Could it be because you know your ideas are not worth the attachment of a na

        • "Troll" does not mean "anything with which I disagree". It is trivial to find citations for the examples I give above. Try the China Aid Society first. Or read up on the Chinese Death Vans — they execute ten times more people per capita than the USA that they admit to and actually had vehicles created for the purpose. The condemned enter the vehicle, and they never leave — and their family is not permitted to see the body, which is considered extremely important by nearly all peoples on the plan

    • Re:Google has BACKED DOWN in China (Score:5, Informative)

      by phantomcircuit ( 938963 ) on Thursday January 21, 2010 @05:21PM (#30852794) Homepage

      Looks pretty un-censored to me. images:tiananmen square [google.cn]

      • Re: (Score:2)

        by selven ( 1556643 )

        I don't think so.

        English version: a few pretty colorful images, one broken bicycle image, 11 tank men.

        Chinese version: 1 tank man, one broken bicycle image, 14 pretty pictures.

        Looks censored to me, with one tank and one broken bicycle so it doesn't look whitewashed.

        • Re: (Score:2)

          by Tim C ( 15259 )

          That may not be google's doing; presumably the google.cn search is going to be favouring Chinese-language pages, while the google.com/.co.uk search will be favouring English-language ones.

          As such, Google may just be reflecting the inherent bias in its source, rather than applying a bias of its own.

      • Re: (Score:3, Funny)

        by kramulous ( 977841 )

        Yup. This [redbubble.net] poor bastard was never seen again.

      • Doesnt really make a difference. The great Firewall of China [wikipedia.org] inspects packets for certain words and spoofs a RST packet to break the connection and blocks that IP for x amount of time. I doubt the Chinese can actually see those results. I wouldnt be surprised if the results were IP based (if china IP then censor).

      • Try to search in Chinese http://images.google.cn/images?q=%E5%A4%A9%E5%AE%89%E9%97%A8%E5%B9%BF%E5%9C%BA&btnG=Google+%E6%90%9C%E7%B4%A2&gbv=2&hl=zh-CN&um=1&sa=2&start=0 [google.cn]

        Generally, the Chinese government does not censor most English contents but almost all Chinese contents.

      • Re: (Score:2)

        by klui ( 457783 )
        If you live in China but speak only English. Applicable to maybe 0.01% (pulled it out of my ass) of the population there.

    • Uum, you know that you can submit stories for the firehose. If it’s interesting (as in this case) it should quickly get voted to the top, and then get put the front page.

    • Mod Parent Up!

    • I probably shouldn't respond to this but Google did the right thing. Their employees would be jailed and maybe even executed if they refuse to follow chinese law while operating inside the country. It would be extremely foolish of them to disregard Chinese law while still operating inside the country because as I said it could even get some innocent employee killed. If they abandon the Chinese market and then still keep the results censored, then you have a complaint but until they pull out the Chinese gove

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      AFAIK, Google never announced that they stopped censoring. So claiming that they "backed-down" is disingenuous. They've already made good on their threat by delaying the release of 2 phones pending talks with the government. Feel free to lambast them once they've concluded the talks and yet still censor results.

    • Re: (Score:2)

      by Tanman ( 90298 )

      I hate to say it, but everyone who thinks Google is going to stand up to losing that much profit (and China IS a land of opportunity for corporations) is fooling themselves. Google is not your friend. Google is a MARKETING COMPANY. They do data mining and advertising. I have no clue why everyone has such a glint in their eye when they think about them.

      Google only published this attack as a method of negotiating with the Chinese. Nothing more.

  • What if IE could be uninstalled? (Score:4, Interesting)

    by davet2001 ( 1550151 ) on Thursday January 21, 2010 @05:18PM (#30852740)
    Since I never use IE and never intend to, it's a shame that there's no uninstall option in XP.

    Removing IE would save me bandwidth on all the patches and more importantly spare me the forced reboots.

    I'd probably find that a lot of rendered local text would stop working without IE such as help pages, but I usually find google more effective than built in help these days any way.

    • Re: (Score:3, Insightful)

      by BitZtream ( 692029 )

      Removing IE is easy, its a wrapper GUI around a browser engine. Delete iexplore.exe, there you deleted IE.

      The rendering engine is in a shared DLL thats used by just about everything now days, even if the app doesn't use the renderer directly, the built in help system is HTML based and uses the shared library for its renderer.

      Its also used by HTML style dialogs, which are basically dialogs that use HTML to define the layout rather than the old style dialog resources.

      This isn't really different from any othe

      • Re: (Score:3, Interesting)

        by WraithCube ( 1391567 )

        Troll? I know the parent missed the point of the GP that the operating system should not depend on an html rendering engine of a buggy browser, but is quite far from a troll. He brings up a good point. There are a lot of apps that for right or wrong use the IE rendering engine, including plenty of in house applications.

        As far as removing IE goes, iexplorer.exe will get rid of the gui leaving just the engine behind it. However, removing an html rendering engine should not break an operating system. Years ago

    • here [techsupportalert.com] is a good way to disable IE and make sure that nothing can access it and all stupefied widows only morons will be forced to use the default browser you set up. There sure as heck would not have a clue as to why IE will not work.

      Then remove the entries from the start menu and take all the icons off the desktop. Of course this is not practical with XP but will work just fine with vista and 7 as the updates are independent of the default browser. It will work if you control the updates in XP and only enab

      • Re: (Score:2)

        by smash ( 1351 )
        Unfortunately, in the real business world there is a metric fuck-tonne of web apps out there that are only supported on IE.

        Rightly or wrongly, disabling IE for many industries is not an option.

    • Re: (Score:1, Informative)

      by Anonymous Coward

      You can use this website to uninstall IE completely: http://www.ubuntu.com/GetUbuntu/download [ubuntu.com]

    • There's times you MAY use it not intending to (Score:1, Informative)

      by Anonymous Coward

      "Since I never use IE and never intend to" - by davet2001 (1550151) on Thursday January 21, @05:18PM (#30852740)

      See my subject-line above, & realize, that SOME apps do not launch by "filetype associations" & FORCE a user into launching IE!

      (Those apps should do it by your default browser file association, ala ShellExecute type API calls for instance in the Win32 API, which would INSTEAD summon the default webbrowser associated with webbrowser files like .html/.htm type file extensions etc. / et al):

      An example thereof would be one like WinVulnScan:

      Now, before I go anywhere pointing out that is "wrong" with it?

  • So IE has a buffer overrun. This wasn't something on port 135...so how did the Chineese get in.

    Did it get in via a viewing of an email inside of Outlook?
    Did some stupid user visit a bad site sent thru email?

    The end user had to go to a site which then allowed a trojan to get install...is this what happened?

  • I know it's exam season Slashdot, but seriously - my lecturers would be proud:

    Say what you are going to say
    Microsoft To Ship Emergency IE Patch [slashdot.org]

    Say it
    Microsoft To Issue Emergency IE Patch [slashdot.org]

    Say what you said
    Microsoft Patches "Google Hack" Flaw In IE [slashdot.org]

  • I just remembered I hadn't ran `sudo apt-get upgrade` for a month or two.

    Not that there's much danger of me getting hacked, but that's a 100mb download. Just imagine how much crap I'd be downloading if you waited for patch Tuesday!

  • "out-of-band" (Score:2, Insightful)

    by oldhack ( 1037484 )
    Ooooh, we all talk like com techs. Aren't we all so clever?

  • Am I the only one who thinks the headline on this reads like common media spin? So basically Microsoft has a bug that happened to be used against Google and the headline reads like Google was doing some hacking. This only leaves me wondering how much did the Microsoft PR people paid to get that worded that way.

    • Re: (Score:2)

      by socsoc ( 1116769 )
      Probably a googol Internet dollars. At today's conversion rates, that's roughly a brazillion USD.

  • Ars Technica has all the download links you need

    And here they are... [arstechnica.com]

Slashdot Top Deals

Kiss your keyboard goodbye!

Close