Microsoft to release out-of-band update (12/17/2008)

[Glenn9999]

http://www.computerworld.com/action/articl...ticleId=9123118

http://www.computerworld.com/action/articl...tsrc=hm_ts_head

http://www.msnbc.msn.com/id/28258894

REDMOND, Wash. - Microsoft Corp. is taking the unusual step of issuing an emergency fix for a security hole in its Internet Explorer software that has exposed millions of users to having their computers taken over by hackers.

Microsoft said it has seen attacks targeting the flaw only in Internet Explorer 7, the most widely used version, but has cautioned that all other current editions of the browser are vulnerable.

http://www.microsoft.com/technet/security/...n/ms08-dec.mspx

It effects everything Internet Explorer.

Probably related to this: http://www.microsoft.com/technet/security/...ory/961051.mspx

Edited December 16, 2008 by Glenn9999

[cluberti]

http://www.microsoft.com/technet/security/...n/MS08-078.mspx

It's available. Install it now.

[Zxian]

Thanks cluberti. Downloaded and installed on all my machines.

[Dude111]

Anyone have a proof of concept link to test your browser?

[cluberti]

Anyone have a proof of concept link to test your browser?

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4844 - links there (obviously not a direct link to the exploit).

[Dude111]

I couldnt find the link to test this.......

http://secunia.com/advisories/33089

That page doesnt have a link to test.... (Im just curious)

[cluberti]

The link I posted above has 2 links (the first two, I think) that contain HTML pages that will repro.

[Dude111]

OK i tried both

MILW0RM:7403

and

MILW0RM:7410

Both did nothing,all i saw was text on my screen.. (Im using IE6)

[cluberti]

OK i tried both

MILW0RM:7403

and

MILW0RM:7410

Both did nothing,all i saw was text on my screen.. (Im using IE6)

What text did you see? Was it HTML code?

[Dude111]

No it was just a script... (Like your supposed to put it in notepad and create a LOCAL .htm file to test it)

I dunno,no biggie i guess....... What do you see when you try these?

[cluberti]

The same - you are supposed to copy that text into an empty .html file, save it, then run it (that's the code that should exploit the vulnerability). Like I said links to the code, but nothing direct (not even the links to the scripts themselves) for obvious reasons.

[Dude111]

Ah ok,i dunno if i wanna try it,have you tried doing that?

What happened if you did?? (I assume its just an example and nothing will be sent to anyone)

[cluberti]

The one runs calc.exe, as an example. The code there is harmless, but obviously the exploit is not.

[Dude111]

Ill try it then

Ill let cha know

EDIT:

I tried 7410 and it just bogged down my browser,nothing happend.... Finally i ended task on my browser and came back here......

Edited December 23, 2008 by Dude111