Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Microsoft Posts VML Patch Two Weeks Early
TechWeb ^ | September 26, 2006 | Gregg Keizer

Posted on 09/26/2006 3:54:43 PM PDT by Eagle9

Microsoft on Tuesday broke with its regular security update schedule for only the second time this year to issue a patch for a critical Internet Explorer vulnerability that's been exploited for more than a week.

MS06-055 provides a fix for the flaw in IE 5.01 and IE 6.0, Microsoft said in the accompany bulletin, and should be applied immediately. The Redmond, Wash. developer pegged the bug as "Critical," its most dire warning, for editions of IE running on Windows 2000, Windows XP, and Windows Server 2003 machines. Windows Server 2003 SP1 is at slightly less risk.

"An attacker who successfully exploited this vulnerability could take complete control of an affected system," the bulletin read. "An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

The vulnerability exists in IE's rendering of Vector Markup Language (VML) code, an extension of XML that defines Web images in vector graphics format. First reported last Tuesday by Sunbelt Software, the vulnerability was quickly leveraged by attackers to plant large quantities of adware, spyware, and other malware on attacked PCs. Within days, a working exploit had been added to WebAttacker, a Russian-created "kit" sold to hackers.

Although Microsoft indicated last week that it might issue a patch before Oct. 10, it gave no warning Tuesday that it would release a fix. MS06-055 is only the second 2006 update to debut outside the normal second-Tuesday-of-the-month schedule; the first was a fix issued Jan. 5 to quash a widely-exploited bug in the Windows Metafile image format.

One possible fly in the update ointment: Microsoft warned users that users who had earlier applied a Microsoft-sanctioned workaround -- one of the few sanctioned defensive measures available while the company worked on a fix -- might not be able to install the Tuesday patch.

"If the workaround 'Modify the Access Control List on Vgx.dll to be more restrictive' has been applied, the security updates provided with this security bulletin may not install correctly," Microsoft said. It told users they should first reverse the workaround by re-registering the Vgx.dll.

In a side note on its blog, the Microsoft Security Response Team also said that the MS06-049 update originally issued Sept. 8 would be re-released Tuesday.


TOPICS: Technical
KEYWORDS: browser; ie; internetexplorer; microsoft; patch; spyware; vml

1 posted on 09/26/2006 3:54:47 PM PDT by Eagle9
[ Post Reply | Private Reply | View Replies]

To: Eagle9

Thanks for the info. I downloaded it.


2 posted on 09/26/2006 4:13:46 PM PDT by Dr. Scarpetta
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9

Must be what downloaded today with the critical warning.


3 posted on 09/26/2006 4:16:07 PM PDT by doodad
[ Post Reply | Private Reply | To 1 | View Replies]

To: rdb3; chance33_98; Calvinist_Dark_Lord; Bush2000; PenguinWry; GodGunsandGuts; CyberCowboy777; ...

4 posted on 09/26/2006 4:29:53 PM PDT by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 1 | View Replies]

To: doodad
Must be what downloaded today with the critical warning.

same here, along with a windows Defender update.

5 posted on 09/26/2006 4:38:00 PM PDT by Echo Talon
[ Post Reply | Private Reply | To 3 | View Replies]

To: doodad
Must be what downloaded today with the critical warning.

Not that I'm a MS basher(currently running XPPro on this box), but doesn't that just give you a moments pause. That something can download from outside your system without your full knowledge of what it is?

Eventually, some hacker is going to take over the MS servers and do a whole lot of damage to the millions of computers out there running WinXP through the automatic update system. That they haven't yet boggles the mind.
6 posted on 09/26/2006 4:41:56 PM PDT by Dr.Zoidberg (Mohammedism - Bringing you only the best of the 6th century for fourteen hundred years.)
[ Post Reply | Private Reply | To 3 | View Replies]

To: Dr.Zoidberg
Not that I'm a MS basher(currently running XPPro on this box), but doesn't that just give you a moments pause. That something can download from outside your system without your full knowledge of what it is?

I have mine setup to just notify me, IT DOESN"T DOWNLOAD ANYTHING... After it alerted me I went to windows update and installed the 2 updates(one was for windows Defender, the other must have been for this)

7 posted on 09/26/2006 4:47:24 PM PDT by Echo Talon
[ Post Reply | Private Reply | To 6 | View Replies]

To: Echo Talon
Thats the same thing I do.

Unfortunately, I expect you and I are in the vast minority.
8 posted on 09/26/2006 4:53:26 PM PDT by Dr.Zoidberg (Mohammedism - Bringing you only the best of the 6th century for fourteen hundred years.)
[ Post Reply | Private Reply | To 7 | View Replies]

To: Eagle9

I've been running IE7 for a while so I never had to worry about this bug.


9 posted on 09/26/2006 4:57:56 PM PDT by COEXERJ145 (Free Republic is Currently Suffering a Pandemic of “Bush Derangement Syndrome.”)
[ Post Reply | Private Reply | To 1 | View Replies]

To: musicman

Bookmark


10 posted on 09/26/2006 5:01:36 PM PDT by musicman
[ Post Reply | Private Reply | To 1 | View Replies]

To: BlessedBeGod
If you don't have SP1 or SP2 installed on your home laptop, Windows Update will not automtically download and install any security patches for WinXP. Microsoft ended support for those without SP1 in 2004, and will end support for those without SP2 after this month, September 2006.

One possible fly in the update ointment: Microsoft warned users that users who had earlier applied a Microsoft-sanctioned workaround -- one of the few sanctioned defensive measures available while the company worked on a fix -- might not be able to install the Tuesday patch.

"If the workaround 'Modify the Access Control List on Vgx.dll to be more restrictive' has been applied, the security updates provided with this security bulletin may not install correctly," Microsoft said. It told users they should first reverse the workaround by re-registering the Vgx.dll.

To reverse workaround:

Click Start, choose Run, and then type

regsvr32 "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll


11 posted on 09/26/2006 5:39:03 PM PDT by Eagle9
[ Post Reply | Private Reply | To 1 | View Replies]

Comment #12 Removed by Moderator

To: Dr. Scarpetta
Thanks for the info. I downloaded it.

Do yourself a favor and get off of IE.

13 posted on 09/26/2006 7:20:02 PM PDT by AFreeBird (If American "cowboy diplomacy" did not exist, it would be necessary to invent it.)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Eagle9
To reverse workaround:

Click Start, choose Run, and then type

Format C:

}:-|

14 posted on 09/26/2006 7:23:19 PM PDT by AFreeBird (If American "cowboy diplomacy" did not exist, it would be necessary to invent it.)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Eagle9

15 posted on 09/26/2006 7:24:52 PM PDT by Jim Noble (Who you gonna call?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9

bump


16 posted on 09/26/2006 8:02:27 PM PDT by VOA
[ Post Reply | Private Reply | To 1 | View Replies]

To: All
TechWeb
Microsoft Re-patches Third Aug. Patch
September 27, 2006
By Gregg Keizer

The same day that Microsoft Corp. went out-of-cycle to issue a fix for a critical flaw in Internet Explorer, it also re-released a security update that had corrupted data on some users' PCs. It was the third patch from August's batch that has had to be re-issued.

Versi0n 2.0 of MS06-049, "Vulnerability in Windows Kernel Could Result in Elevation of Privilege," was posted Tuesday in response to warnings earlier this month from Microsoft that the Aug. 8 edition could ruin files on NTFS formatted drives when the PC used Windows' own compression schemes.

Then, Microsoft said while it had created a hotfix, customers had to contact the support desk to obtain a copy. The revised MS06-049 released Tuesday rolled that hotfix into the older update.

Microsoft has recently had to regularly re-issue patches, occasionally multiple times, to fix newly introduced bugs or overlooked flaws. Two weeks ago, it released an August update for Internet Explorer, MS06-042, for the third time. The same day, the Redmond, Wash.-based developer also re-released MS06-040, another August update.

17 posted on 09/27/2006 12:50:48 PM PDT by Eagle9
[ Post Reply | Private Reply | To 1 | View Replies]

To: Dr.Zoidberg

Not really because I initiated it from the start when I set up the computer and control the access through the router and firewall. Only sources I trust get that privilege.


18 posted on 09/27/2006 1:55:47 PM PDT by doodad
[ Post Reply | Private Reply | To 6 | View Replies]

To: AFreeBird
Do yourself a favor and get off of IE.

I haven't had a problem with it so far.

19 posted on 09/27/2006 2:42:53 PM PDT by Dr. Scarpetta
[ Post Reply | Private Reply | To 13 | View Replies]

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson