[Merged] Microsoft Security Updates

[Caspar]

I suspect the virus JPEG would be porn related or some other high hitting context

[Bifta]

Originally Posted by Chris T

BBC report here on the latest vulnerability in M$ products. Our corporate IT guys here are on the ball though, the patch ran as I logged in this morning,

http://news.bbc.co.uk/1/hi/technology/3661678.stm

I don't know what's funnier, that M$ has been caught out again, that the BBC used a photo of Avril Lavigne to illustrate the fact that JPEGS can put viruses on your PC or that the image alt caption for Avril was 'Pop singer' ...

http://www.cableforum.co.uk/board/sh...ad.php?t=17521 not sure if it's the same.

Originally Posted by Aragorn

Chris,

While commenting about vulnerable browsers, looking at your sig I hope you've taken notice of http://www.theregister.co.uk/2004/09...zilla_patches/ - a whole load of vulns in Firefox and mozilla .
BTW, I'm not knocking Firefox - I use it myself for browsing anything outside the company firewall - safer and quicker than IE (sure I'll be flamed about that statement !)

Steve.

Now that would be off topic

Looking at that Reg article, there is clearly a radically different philosophy towards secutity and approach towards fixing bugs. In the longer term this is going to mean fewer problems with Mozilla-based software and more rapid fixes.

Originally Posted by Bifta

http://www.cableforum.co.uk/board/sh...ad.php?t=17521 not sure if it's the same.

Wups you're right

Merging...

Not sure why this is closed, a side effect of the merge I think. Re-opened.

[Ramrod]

Just patched both of our 'puters. If you have MS office you need to patch that as well........

[Paul K]

Strange do I detect a seemless merge??? Apart from a post going missing

Originally Posted by Paul

Strange do I detect a seemless merge??? Apart from a post going missing

It might look that way to you, but from where I'm sitting there are bodies everywhere

Funny it said I didn't need to patch M$ Office.Oh well.

It did try very hard to persuade me to download SP2 though.

[Ramrod]

Originally Posted by Incognitas

Funny it said I didn't need to patch M$ Office.Oh well.

Go to the office page and click on updates......see if it mentions the vulnerability, it did on my wifes laptop.

[Paul K]

Originally Posted by Incognitas

Funny it said I didn't need to patch M$ Office.Oh well.

It did try very hard to persuade me to download SP2 though.

Windows Update will not tell you about Office updates, that's a different update engine alltogether Follow Ramrods instructions and you should be prompted for any updates you require.

Originally Posted by Paul

Windows Update will not tell you about Office updates, that's a different update engine alltogether Follow Ramrods instructions and you should be prompted for any updates you require.

its quite misleading - well for me, using Win98se, it was. Windows Update identified 2 'critical' updates available - one an IE6 patch & the other the patch for the jpg file vulnerability. During installation the jpg file thingy loads a new page which advises a 4 point check - one of which is a link to check if Office needs updating, I think that is what Incog meant.

[MovedGoalPosts]

Just received an email from my antivirus provider Panda, that the virus writers out there now have a nice scripting kit ready to exploit the JPEG vulnerability mentioned earlier in this thread. Great now even innocent photos aren't safe.

No doubt someone will find a way to attach viruses to PDFs soon.

[MetaWraith]

Nothing is safe as long as sloppy coding, no checking for buffer overruns etc is tolerated.

Infact in today's modern society it's even encouraged as part of the rush to get the product to market first,and spin off whole update industries.

[Stuart]

The memory protections functions in Xp Service Pack 2 SHOULD reduce the effect of buffer overruns in the future, but, by default only protect the Operating System (and don't work fully unless you have hardware support ).