(no subject)

[kuangning]

Btw, folks, in case the news has missed you, there's yet another Windows vulnerability that's quickly being exploited. This one involves many Microsoft programs that handle JPEG image files -- which include, of course, the ever-lovable IE and Outlook. If you're running MS products, you should check here for a list of affected software and links to their patches. Note that you're going to need to run a patch separately for each piece of vulnerable software on your machine.

(And no, you're not perfectly safe if you use Firefox and don't use Outlook. If there's a real difference between Windows Explorer and IE, I haven't seen it -- try typing a URL into a Windows Explorer window sometime and see what happens. If you have on your machine MS products that show images, this bulletin's for you.)

Comments

[rbos.livejournal.com]

I tested exploit code on Firefox a while back under Windows on both 2k and XP; no effect. I don't think it uses the Windows rendering library. Do you have a source for this?

[kuangning]

The link given (http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx) is Microsoft's own security bulletin. Further information on the way the vulnerability's already being exploited is here and here as well. Note that if you've grabbed the jpeg with Firefox or something non-vulnerable but then attempt to click on it with an unpatched version of Windows, the effect is the same.

[salinn.livejournal.com]

I knew there was a reason I used Win 98. Although some of the work computers might have to be checked out...

[kuangning]

Be sure to look up your version of IE and any Office products you're running as well as your operating system -- they have to be patched separately.

[salinn.livejournal.com]

okay, I went to windows update and they told me there was one new critical update, something that sensed whether I had these .NET things and other products that might use this entryway into my system, it said that I did not. But this is my work computer, I haven't tried it at home yet. Does windows update catch this?

[kuangning]

I'm not sure, since I didn't use Windows update -- I went and downloaded patches separately from the bulletin page. I think all the windows update does is tell you what .Net things you're running, and then bring you back so you can get the patches for the ones you have.