Flawed: "Microsoft releases security update to block new virus transmitters"
usatoday.com
By Anick Jesdanun, Associated Press
NEW YORK — Microsoft has issued an interim security update to protect users of its nearly ubiquitous Internet Explorer browsers from a new technique for spreading viruses.
The update does not entirely fix the flaw that makes the spread possible, but it changes settings in Windows operating systems to disable hackers' ability to deliver malicious code with it.
The security measure came Friday in response to last week's discovery of a computer virus designed to steal valuable information like passwords. Though its outbreak was mild, security experts said the technique for spreading it was novel and could be used to send spam or launch broad attacks to cripple the Internet.
Hackers had converted hundreds and possibly thousands of Web sites into virus transmitters by first hiding malicious code using a vulnerability with Microsoft's software for operating Web sites. A fix for it had been issued in April but was not universally applied.
Two other flaws in Microsoft products allowed hackers to direct Internet Explorer browsers to automatically run the virus when visiting an infected site.
Though one of those flaws remains unfixed, Friday's setting changes thwart any attack by prohibiting a Web application from writing files — such as the virus code — onto users' computers.
The U.S. Computer Emergency Readiness Team urged computer users to install the update, saying it would greatly increase protection. But the advisory warned other types of attack remain possible.
Stephen Toulouse, a security program manager at Microsoft, said the company still was working on a comprehensive patch to fix vulnerabilities with Internet Explorer, but the settings change should protect users from the immediate threat.
The software update covers Windows XP, Windows Server 2003 and Windows 2000, and Microsoft was working on ones for older systems.
The update will also be included with a major Windows XP upgrade, called Service Pack 2, later this summer. Toulouse said the Service Pack will include additional protections.
After installing Friday's update, users should be able to lower their security settings from the "high" one initially recommended as a stopgap, he said.
Russ Cooper, a senior researcher at TruSecure, welcomed Friday's update, but said it should have come sooner than a week.
"It would have taken a couple of hours to put it together as a package, and (the testing) process can take a day or two," Cooper said.
But Toulouse said that given the broad user base for Windows and Internet Explorer, even a problem affecting less than 1% of users potentially hurts millions of customers.
He said the settings could potentially affect legitimate applications used internally by Web developers and corporate networks, and special instructions were available to address those cases.
The update will be automatically installed if computers are set to receive it. It is also available at windowsupdate.microsoft.com.
Microsoft shares fell 6 cents to close at $28.57 Friday on the Nasdaq Stock Market. |
