Microsoft patches critical IE bug with emergency update
Researchers give the company high marks for getting a fix out fast
Computerworld - As it promised yesterday, Microsoft Corp. today issued an emergency patch to plug a critical hole in Internet Explorer (IE) that attackers have been increasingly exploiting from hacked Web sites.
The patch, described in Microsoft's security bulletin MS08-078, fixes a flaw in the data-binding function of all available versions of the popular browser, including IE5.01, IE6, IE7 and IE8 Beta 2.
Microsoft labeled the bug as "critical," the most serious threat ranking in its four-step scoring system. Today's update was the second out-of-cycle patch from Microsoft in the past two months.
Researchers unanimously praised Microsoft for putting out the patch as quickly as it did.
"This was clearly an all-hands-on deck effort," said Eric Schultze, chief technology officer at Shavlik Technologies LLC. "The out-of-band process worked exactly as intended in this case."
Andrew Storms, the director of security operations at nCircle Network Security Inc., seconded Schultze. "This was a classic case of what we would like to happen. Microsoft acknowledged the fault, issued work-arounds, gave us advance notice that it would patch and then released the patch," he said.
Wolfgang Kandek, chief technology officer at Qualys Inc., also applauded Microsoft. "Considering the way that Microsoft is set up, I thought this was pretty quick," he said.
Microsoft first acknowledged the vulnerability a week ago today, one day after it unleashed its biggest set of security updates in more than five years. At the time, it said that only the newest production version of the browser, IE7, was at risk, but the company quickly changed its tune when additional research revealed that all versions contained the bug.
According to both Microsoft and numerous security firms, attacks have been mounting, particularly since last weekend, when hackers began hijacking legitimate Web sites and launching exploits against unwary visitors. In fact, Microsoft said it monitored a "huge increase" in attacks last Saturday.
Reports of the vulnerability and publicly-available exploit code first surfaced Dec. 9, although at least one researcher said he had found evidence of attacks starting three days before.
In any case, Microsoft was quick to respond, said researchers. "They're getting better in terms of their speed and agility to respond," said Storms. "Actually, today was very anticlimactic. Probably the biggest part of this was all the build-up."
The analysts agreed that Microsoft didn't act in a vacuum, but pushed the patch process because of the attack situation. "By late last week, Microsoft was aware that this issue was starting to infect users' systems at a faster rate than they've seen with past zero-day exploits," said Schultze in a follow-up e-mail today.
"They fixed this so quickly because [the exploit] became public," added Storms.
- QA Automation: Reducing Test Execution While Improving Coverage A leading capital investment firm in the US was in need of a comprehensive, cost effective and flexible solution to reduce their existing...
- Tablet, Laptop, or Desktop - Form (Factor) Follows Function Desktops, laptops, Ultrabooks, tablets, convertibles, and all-in-ones; suddenly hardware decisions seem a lot more complicated. To take advantage of these benefits, the savviest...
- The IT handbook for Windows 7 and Windows 8 migrations A comprehensive guide for IT departments making the switch from legacy versions of Microsoft Windows to Windows 7 and Windows 8. To date,...
- 7 Reasons Why Windows 8 is the Future Touch, cloud, BYOD and IT consumerization dominate the mindshare of IT managers. Windows 8 enters the scene with a host of features that...
- Cloud BI in Action: Recorded Webinar of Customer, Kony, Inc. See how Kony, Inc., a leading enterprise mobility company, is using TIBCO Jaspersoft for Amazon Web Services and Redshift to achieve embedded analytics...
- Cloud BI Overview: Jaspersoft for AWS Check out this overview of Jaspersoft for AWS, to easily and affordably build business intelligence solutions as well as embed visualizations and analytics... All Operating Systems White Papers | Webcasts