All the major browsers need security fixes for bugs
Thursday, April 29, 2010 8:16Whatever you use to surf the Web needs a fix. Developers of all five major browsers — Chrome, Firefox, Internet Explorer, Safari, and Opera — recently released important security patches.
To head off a growing number of attacks against a publicly known security bug, Microsoft took the unusual step of releasing IE’s fix outside its usual Patch Tuesday monthly update cycle. The cumulative IE patch closes a total of 10 bugs, the most significant of which let bad guys to invade a PC via IE 6 or IE 7 using a malicious Web page. Attacks against the flaw started out small-scale, but became more prevalent within a few weeks.
[ The Web browser is your portal to the world -- as well as the conduit that lets in many security threats. InfoWorld's expert contributors show you how to secure your Web browsers in this "Web Browser Security Deep Dive" PDF guide. ]
While IE 8 wasn’t affected by this flaw, it needed several other fixes present in the cumulative patch. Whatever your combination of Windows and IE, odds are the patch is rated critical for you, since only Windows Server 2003 with IE 6 or IE 8, and Windows Server 2008 with IE 8, get anything less than a critical rating. Pick up the fix via Windows Update, and for more details see Microsoft’s security bulletin.
Unfixed IE flaw
But IE users on Windows 2000 and XP can’t let their guard down even after installing the fix. Another vulnerability that allows a specially crafted site to use VBScript to get to unsafe Windows Help files through Internet Explorer remains unfixed. But there’s a warning sign: An attack would have to display a dialog box that asks you to press the F1 key. If you don’t hit F1, the attack won’t trigger.
Windows Server 2003 is also affected, but Windows 7, Vista, and Server 2008 are not. Techie users comfortable with the Windows command line can apply a workaround to “lock down the legacy Windows Help system.” Get the instructions.
