Internet Explorer patch coming tomorrow
Microsoft has confirmed it will issue a patch for the most recent Internet Explorer security flaw tomorrow. But it urges all users to upgrade to version 8 as well as using the patch.
Tomorrow’s release is what’s known as an “out-of-cycle update” in Microsoft lingo and an “emergency patch” for those less corporately minded. Whenever such an event happens it inevitably draws attention to a problem and denotes it as fairly serious but, to its credit, there’s never been any serious suggestion that Microsoft has delayed an urgent patch until the next scheduled monthly update for public relations reasons.
The firm says there are three reasons for issuing an update now:
- the level of media attention;
- confusion among the public about suitable measures for protecting their computer; and
- an “escalating threat environment”.
The latter phrase refers to the fact that, so far as security researchers can tell, there’s no evidence yet of any successful attacks outside of the Google incident in China, but there is a very clear level of interest among would-be hackers in exploiting the issue, particularly before a patch is available.
McAfee has issued a tool which can specifically identify and remove any viruses which have been transmitted via the IE loophole in question. However, the firm has noted that this does not the fix the flaw itself and warned against using a so-called third-party fix which is floating about and does not come from Microsoft. As the firm’s George Kurtz noted, “applying a patch from an unknown source for software that was created by someone else just isn’t a good idea.”
As we noted, Microsoft has argued that though the issue affects all versions of Internet Explorer, both versions 7 and 8 have safeguards which limit the bug’s dangers. You might wonder why anyone, particularly in a corporation where the bounty for hackers is potentially much greater than on a home user’s machine, would still be using an outdated version of Internet Explorer. Amazingly a BBC correspondent discovered Britain’s Ministry of Defence is still running IE version 6. Officials said this wasn’t a problem as, by its very nature, the department has tighter than usual security measures around its network.
Related Posts:
January 23rd, 2010
I work in the public sector in South Australia. Government policy dictates that we also have to put up with IE6…in direct contravention of the warning from the Federal Governmentwhich was broadcast in the national media during the week.