Microsoft has patched an under-attack zero-day vulnerability in XML Core Services as part of the July edition of Patch Tuesday.Translation in plain English: get patching. Windows 7 users can go to the taskbar "Show Hidden Icons" thingie, and will find Windows Update in that list. Everyone can also take Internet Explorer (it has to be Microsoft's browser) to microsoft.com/security to hit the link on the left called Security Updates.
The critical security update (MS12-043) addresses a security flaw that has made its way into the Blackhole Exploit toolkit since its discovery last month. A further two critical updates cover a cumulative security update for Internet Explorer and a remote code execution flaw in MS Data Access Components (a part of Windows), respectively. The six other bulletin issued on Tuesday cover lesser security flaws.
...
Storms added that the IE patch is significant because it represents a step up in frequency for browser security updates from Microsoft.
You want this one, folks, since it fixes a ton of other bugs and sets you up with a new updater to pull down new revoked security certificates. It seems that certificate hacking is the new security hotness, so this seems pretty big.
4 comments:
Already patched, but thanks for the heads up.
Sweet and thanks for the plain English explanation:)
I started seeing certificate hacks out in the wild a few weeks before MS announced it; including a server out in China spoofing as an MSUpdate server.
They were even advertising BGP for an unused portion of an MS owned netblock.
The only reason I knew they were illegit, was because it was because I was doing traffic analysis on a rootkitted machine, and it shouldn't have been contacting any MSupdate servers directly, so I chased it down.
I keep on top of updates, and have ditched IE in favor of Firefox. My antivirus stays up to date and scans daily. I know way too many folks who don't bother with any of that, for some reason, even though its mostly automated these days.
Post a Comment