[ news_security_news ]
Microsoft Patch Missed The Target?
Doug Caverly
Staff Writer
2006-07-25
 Insider Reports RSS Feed
The existence of a Windows vulnerability (and/or malware that targets it) is announced. Microsoft offers a patch, which everyone downloads, and everything is fine again for a while. That's how it usually goes, anyway. But Microsoft may not have completely secured one recent vulnerability.
Joris Evers of CNET wrote about this "proof-of-concept code" that "targets a security hole in a Windows component called ‘mailslot.'" Symantec and FRSIRT said that Microsoft patched the flaw. "However," Evers continued, "Microsoft said it believes the code takes advantage of a new flaw."
"The company is monitoring this situation and may issue another patch, to fix the variant, the representative said," Evers reported. That might be a good idea - "security experts pointed to the ‘mailslot' vulnerability as the most risky in Microsoft's July patch bunch."
There's no need to get too worked up, though. "The proof-of-concept code released over the weekend does not have as severe an effect; all it can do is crash a computer, Symantec said."
Another exploit code has also come to light, although Microsoft seems to have prepared for this one. It "takes advantage of a ‘critical' flaw in the Windows Dynamic Host Configuration Protocol, or DHCP, client," Evers wrote. "An attacker could gain full control over an unpatched Windows computer using the exploit, Symantec said," but "Microsoft released a fix on July 11 for the problem."
The news of the not-really-patched vulnerability comes within a week of the announcement of attacks against PowerPoint through a zero-day flaw. Microsoft is supposed to issue a patch for that on August 8, if not sooner. Perhaps they can take care of the "mailslot" vulnerability while they're at it.
Microsoft
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
Doug is a staff writer for SecurityProNews, InternetFinancialNews, SearchNewz, and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
