Microsoft releases serious patch

SRTDodge05 · 12-04-2007, 06:34 AM

SOFTWARE giant, Microsoft has released a patch for a serious security vulnerability that allows attackers to seize control of millions of computers.
The bug was found by ethical hacker and software engineer Beau Butler last month.
Apparently, the hole was so big that Vole worked solidly for two weeks to find a fix for it.
The problem is in the way IE automatically configures proxy settings and leads to PCs downloading configuration information from the internet instead of their ISP.

Microsoft releases serious patch - The INQUIRER

TQ · 12-04-2007, 07:18 AM

It's interesting how the Inq chooses its headline to say OMIGODTHERESABIGMICROSOFTPROBLEM and then buries the fact that Firefox has the same issue.

**Sandog** · 12-04-2007, 07:54 AM

It wouldn't be any other way. Look for increased MS bashing as there really isn't a competitor to Intel any longer.

SpeedDMN · 12-04-2007, 10:27 AM

Quote:

Originally Posted by Sandog

It wouldn't be any other way. Look for increased MS bashing as there really isn't a competitor to Intel any longer.

Don't you mean "vole" bashing?

Have you or anyone seen this update? I get nothing this morning in fact I haven't had an update since 11/13 so I am wondering what's going on.

Bofinn · 12-04-2007, 10:56 AM

I wonder if this is why I lose my internet connection over night. Problem started 3 or 4 weeks ago. I have to reboot to get my connection.

**k0NG0** · 12-04-2007, 11:07 AM

Quote:

Originally Posted by Bofinn

I wonder if this is why I lose my internet connection over night. Problem started 3 or 4 weeks ago. I have to reboot to get my connection.

Are you using proxy auto-detection?

**k0NG0** · 12-04-2007, 11:30 AM

Quote:

Originally Posted by TQ

It's interesting how the Inq chooses its headline to say OMIGODTHERESABIGMICROSOFTPROBLEM and then buries the fact that Firefox has the same issue.

If you check out the original SMH article, Firefox is only mentioned in a single sentence there as well. From poking at Mozilla's Bugzilla, WPAD is implemented according to the standard (however bad that standard is), and there is no visible (to me, at least) bug on this issue, and no references to this Beau Butler. Secunia only lists Microsoft products as affected in their page on this issue.

I would assume he reported the bug using the official channels if this was a serious security issue for Firefox (or else his label of "ethical hacker" would be something of a misnomer). I would also assume that a fix would've been implemented shortly after that if there actually are risks of this screwing with people.

I've followed Firefox development quite closely for over a year now and I can say with very little doubt that had this been reported, it wouldn't have been quieted down or hidden away in any way. Anyone can register at Bugzilla and file a bug.

Sir Skully · 12-04-2007, 12:54 PM

Opera, glad I use it!!

polonyc2 · 12-04-2007, 09:32 PM

so where do I find this patch??...if it was that serious you would think they would have put it under Windows Update or made it easily accesible...anyone have a link to this patch?

**Gorganzola** · 12-04-2007, 10:58 PM

Maybe it's one of those they install without you knowing.

Bofinn · 12-05-2007, 09:09 AM

Quote:

Originally Posted by k0NG0

Are you using proxy auto-detection?

yes. I updated all my patches, left the computer alone for 2 hours and lost connection again. But my mail still worked. So I have an IE problem.

I unplugged the modem and router to no avail. Only a reboot will fix my connection.

**Gorganzola** · 12-06-2007, 12:23 AM

IE7 or IE6?

Quote:

Originally Posted by Bofinn

yes. I updated all my patches, left the computer alone for 2 hours and lost connection again. But my mail still worked. So I have an IE problem.

I unplugged the modem and router to no avail. Only a reboot will fix my connection.

Bofinn · 12-06-2007, 08:55 AM

Ie7...

**k0NG0** · 12-06-2007, 09:13 AM

I seriously doubt this is your problem anyway. It's a security issue. By registering a wpad sub-domain an attacker can redirect traffic through his own server, since that's what the WPAD protocol looks for. The problem is that the implementation in Windows checked for that particular sub-domain at a level where it wasn't supposed to do so.

I don't see how this flaw would create random connection drops.

**Gorganzola** · 12-07-2007, 01:29 AM

Open Internet Options, go to the Advanced tab, and hit the Reset... button. That will assert defaults for everything across the board for IE. It is far more powerful then IE6 could ever do.

Quote:

Originally Posted by Bofinn

Ie7...

12-04-2007, 06:34 AM	#1
SRTDodge05 Grab Life By The Balls Join Date: Jan 2003 Location: Michigan Posts: 7,835	Microsoft releases serious patch SOFTWARE giant, Microsoft has released a patch for a serious security vulnerability that allows attackers to seize control of millions of computers. The bug was found by ethical hacker and software engineer Beau Butler last month. Apparently, the hole was so big that Vole worked solidly for two weeks to find a fix for it. The problem is in the way IE automatically configures proxy settings and leads to PCs downloading configuration information from the internet instead of their ISP. Microsoft releases serious patch - The INQUIRER
(Offline)

12-04-2007, 07:18 AM	#2
TQ You gonna throw that? Join Date: Mar 2001 Location: Austin, TX Posts: 8,442	Re: Microsoft releases serious patch It's interesting how the Inq chooses its headline to say OMIGODTHERESABIGMICROSOFTPROBLEM and then buries the fact that Firefox has the same issue. __________________ Create in me a pure heart, O God, and renew a steadfast spirit within me - Psalm 51:10 My goal in life is to be as good of a person as my dogs already think I am... Daywalker Studio: Software: Adobe Audition 3.0/Pro Tools LE 7.4/Acid Pro 6.0/Multiple VST, DirectX and RTAS plugins/Kontakt 3 Sampler/Windows XP Professional PC Hardware: D975XBX2-504/E6600/4x2GB Mushkin XP2-6400/eVGA 800GTX/HP f1905 19" flat panel/Echo Audio Gina24 Sound Card/2 Maxtor 6B300SO's/1 Maxtor STM500AS/1 Western Digital WD2500JD/PleXwriter Premium/Plextor 716A/Samsung LightScribe DVD burner/Logitech Revolution MX/Antec P-180b/PPC&C Silencer 610/Zalman CNPS9500 HSF Recording Hardware: Mbox 2 Factory Pro/Mackie SR24.4VLZ Pro Console/M-Audio Axiom 25 MIDI Controller/Audio-Technica 4033a microphone/Symetrix 528E/PreSonus Eureka/Mackie MR8 active monitors Game Machine: Gigabyte GA-X48-DQ6/E8400/4x2GB Mushkin XP2-8500/BFG GTX280/HP f2105 21" flat panel/Creative Labs X-Fi Elite Pro/Maxtor 6H500F0/Maxtor STM3320/Western Digital WD4000KD/Plextor 760A/Toshiba DVD-ROM/Zalman CNPS9700/Antec P-180/PPC&C Silencer 610/Ideazon Merc Stealth keyboard/Vista Business64 SP1
(Offline)

12-04-2007, 07:54 AM	#3
Sandog Moderator Join Date: May 2003 Posts: 6,688	Re: Microsoft releases serious patch It wouldn't be any other way. Look for increased MS bashing as there really isn't a competitor to Intel any longer.
(Offline)

12-04-2007, 10:56 AM	#5
Bofinn I'm gettin' dizzy! Join Date: Jan 2004 Location: Chicagoland Posts: 11,064	Re: Microsoft releases serious patch I wonder if this is why I lose my internet connection over night. Problem started 3 or 4 weeks ago. I have to reboot to get my connection. __________________ ---------- JimBo ----------- When in doubt, smack it!
(Offline)

12-04-2007, 12:54 PM	#8
Sir Skully ABX KNIGHT EXEMPLAR Join Date: Feb 2001 Location: USA-GA Posts: 28,333	Re: Microsoft releases serious patch Opera, glad I use it!! __________________ .....................................................................................................................
(Offline)

12-04-2007, 09:32 PM	#9
polonyc2 Banned Join Date: Jan 2004 Location: New York City Posts: 8,200	so where do I find this patch??...if it was that serious you would think they would have put it under Windows Update or made it easily accesible...anyone have a link to this patch? __________________ ASUS Maximus Formula (X38) *** XFX GTX 260 Black Edition Core 216 896MB Intel E8400 * Noctua NH-U12P G.Skill 4 GB (2 X 2 GB) DDR2 800 4-4-4-12 * Western Digital Caviar Black 640GB WD6401AALS Lian Li PC-A70B (black) * Corsair HX850W AuzenTech Auzen X-Fi Prelude 7.1 * Creative Inspire P5800 5.1 speakers Sony Optiarc AD-7240S-0B * Sony GDM-F520 21' CRT monitor (19.8' viewable) Vista Business 64-bit w/SP2 * standard 3.5" floppy drive Microsoft Laser Mouse 6000 *** Microsoft Wired Keyboard 500 (Black)
(Offline)

12-04-2007, 10:58 PM	#10
Gorganzola ABXZone > Facebook Join Date: May 2001 Location: Hangin' with the fruits Posts: 9,510	Re: Microsoft releases serious patch Maybe it's one of those they install without you knowing. __________________ TTFN. I wasn't asleep at the switch, I was drunk. -- Homer J. Simpson Q. How many dull people does it take to change a lightbulb? A. One. A very useful tool on these forums: You can Meebo in public.
(Offline)

12-06-2007, 08:55 AM	#13
Bofinn I'm gettin' dizzy! Join Date: Jan 2004 Location: Chicagoland Posts: 11,064	Re: Microsoft releases serious patch Ie7... __________________ ---------- JimBo ----------- When in doubt, smack it!
(Offline)

12-06-2007, 09:13 AM	#14
k0NG0 Remembering TQ Join Date: Mar 2001 Location: Sweden Posts: 13,750	Re: Microsoft releases serious patch I seriously doubt this is your problem anyway. It's a security issue. By registering a wpad sub-domain an attacker can redirect traffic through his own server, since that's what the WPAD protocol looks for. The problem is that the implementation in Windows checked for that particular sub-domain at a level where it wasn't supposed to do so. I don't see how this flaw would create random connection drops. __________________ Use Firefox - "the one that blocks all the schmutz" Feeling multicore elation? Remember this correlation: Amdahl's Law.
(Offline)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode