Feeds

Microsoft half fixes serious IE vuln

Download.Ject patches pending

  • alert
  • submit to reddit

Boost IT visibility and business value

Microsoft issued a workaround today to guard against a serious vulnerability in Internet Explorer which created a way for hackers to turn popular websites into conduits for viral transmission.

Configuration changes to the Windows XP, Windows Server 2003 and Windows 2000 operating systems introduced today do not fix the underlying problem with IE, but they do protect against the Download.Ject attack. The configuration changes are currently available on Microsoft’s Download Centre and will be made available later today through Windows Update. Microsoft is working on a series of patches to provide a more comprehensive fix. It didn’t say when they would be available.

On 24 June many websites running IIS 5 were infected with malicious JavaScript code called Download.Ject. Websites running the latest versions of Microsoft IIS were unaffected. If IE users visited websites hosting Download.Ject their PCs attempted to download a virus from a Russian website.

Acting with law enforcement authorities, Microsoft was able to rapidly shut down the Russian website, but the affair still highlighted security concerns with IE. Security clearing house US-CERT took the extraordinary step of advising users to ditch IE in favour of alternative browsers.

Most embarrassing.

Microsoft is "continuing to work with law enforcement and industry partners to identify the individuals or entities responsible for Download.Ject Internet attack, and bring those responsible for this criminal act to justice". ®

Related stories

Malware attacks IE users via pop-ups
CERT recommends anything but IE
Internet Explorer. Quick, call security!
Gates defends Microsoft patch efforts
MS hatches June patch batch

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?