Legal Research

69% Of You Have A Problem [UPDATED]

That would be all of you IE users.  There’s a serious security flaw that hasn’t been patched.  Wired reports that there’s already been an exploit aimed at stealing passwords for games.  But you can bet there’ll be others coming along that will look for other, more lucrative stuff, such as credit card numbers.

Which version of IE is at risk, you may ask.  Microsoft’s Security Advisory 961051 is helpful in that regard:

“Our investigation so far has shown that these attacks are only against Windows Internet Explorer 7 on supported editions of Windows XP Service Pack 2, Windows XP Service Pack 3, Windows Server 2003 Service Pack 1, Windows Server 2003 Service Pack 2, Windows Vista, Windows Vista Service Pack 1, and Windows Server 2008.  Microsoft Internet Explorer 5.01 Service Pack 4, Microsoft Internet Explorer 6 Service Pack 1, Microsoft Internet Explorer 6, and Windows Internet Explorer 8 Beta 2 on all supported versions of Microsoft Windows are potentially vulnerable.”

In other words: every dang one of them.

The Advisory lists 9 workarounds that “will not correct the underlying vulnerability”, but will “help block known attack vectors.”  I can make it a lot simpler for you: use Firefox.  Or Google Chrome.  Or Opera.  Or even Safari.

UPDATE, 12/17 - Microsoft will release a patch today.  If you have the Windows Update feature in XP or Vista turned on, you’ll get it automatically.

Full post as published by Jenkins Webblits on December 16, 2008 (boomark / email).