Feeds

MS hatches July patch batch

Unmagnificent seven

  • alert
  • submit to reddit

High performance access to file storage

Microsoft released seven new patches yesterday. There's some help for IE users worried about last month's Download.Ject security scare, but you are going to have to wait for a comprehensive fix.

Two of the fixes - involving flaws with Windows Task Task Scheduler (MS04-022) and the HTML help function used by Internet Explorer (MS04-023) - are deemed to be critical. Either of these flaws could be used to take control of vulnerable systems, Microsoft warns.

Redmond also released a patch MS04-021 for a less serious flaw involving older versions of its Internet Information Services Web server software (IIS 4.0). This along with fixes for flaws involving the user interface, or shell, or Microsoft Windows (MS04-024); Microsoft Windows Utility Manager (MS04-019) and POSIX Subsystem of Microsoft Windows (MS04-020) are described by Microsoft at important. Finally there’s an update designed to fix a moderate vulnerability with Outlook Express (MS04-018).

Separately Microsoft released a tool to clean up machines infected during last month's Download.Ject security flap. Users visiting a website contaminated with Download.Ject activated a script that downloaded a Trojan horse (called Berbew) from a website in Russia. This website was rapidly taken down, but the underlying vulnerability in Internet Explorer used in the Download.Ject attack remains unpatched, despite a workaround from Microsoft designed to limit the scope for mischief.

Redmond released these configuration changes earlier this month and yesterday followed up tool to remove variants of the Berbew Trojan from infected systems. Berbew (AKA Webber or Padodor) is capable of extracting passwords and login details from victims and forwarding this confidential data to crackers.

The risk posed by future Download.Ject-style attacks prompted security clearing house tUS-CERT o advise users to ditch IE, a call repeated by security experts today.

Thomas Kristensen, CTO at security firm Secunia, told El Reg: "There are a variety of vulnerabilities with Internet Explorer that have been around for a while and are been actively exploited. Several are unpatched. We recommend our customers to use another browser for general web surfing and to limit their use of IE to trusted websites where its functionality is required, such as banking websites." ®

Related stories

MS hatches July patch batch
Malware attacks IE users via pop-ups
CERT recommends anything but IE
Microsoft half fixes serious IE vuln
IE workaround a non-starter
Mozilla takes bite out of IE

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.