Microsoft promises fix for IE security flaw in next few days

[Brink]

Microsoft said today it will issue a fix soon for a security flaw that affects users of Internet Explorer versions 6 through 9.

Uncovered this past weekend, the security hole could compromise the PCs of IE users who surf to a malicious Web site. The flaw is being actively exploited to deliver a back-door trojan known as "Poison Ivy."

The software giant said in a security advisory this afternoon that a solution to the flaw would be released in the next few days.

Read more at source:
Microsoft promises fix for IE security flaw in next few days | Security & Privacy - CNET News



Update:
Microsoft Security Advisory (2757760): Vulnerability in Internet Explorer Could Allow Remote Code Execution

See also:
http://www.sevenforums.com/tutorials/133386-enhanced-mitigation-experience-toolkit-emet.html

 

[Layback Bear]

I wonder how many days is a few days.

 

[pincushion]

I wonder how many days is a few days.

9th October apparently - next update - but I'm not applying the 'fix' since it apparently might screw with existing applications and NIS is said to recognise the malware.

 

[latecomer]

i have no problem with viruses or trojans when web browsing. every malicous site i visited microsoft security esstential caught it and quarantine it before it could be installed.

 

[Layback Bear]

I would hope that all anti viruses would stop this old type of infection. I would still like to have both security methods used. A security update for I.E. and a proper anti virus definition for this problem. Some of the viruses seam to find a way to tip toe around one layer of protection. Paranoia is another layer of protection.

 

[latecomer]

for anti-virus software to work perfectly the users has to help by taking the extra precautions. i reads some threat blogs of antivirus companies saying how hackers are exploiting their attacks on win xp adobe flash player java and any other browser other than internet explorer 9.
most people when installing internet explorer use the custom install option so they dont get the full protection as they would if they used the recommended install. i use to install the custom way, got viruses and tracking cookies when i had vista on here, installed win7 two years ago and installed using recommended and havent had a virus or tracking cookie since.

 

[gigagiggles]

< most people when installing internet explorer use the custom install option so they dont get the full protection as they would if they used the recommended install. i use to install the custom way, got viruses and tracking cookies when i had vista on here, installed win7 two years ago and installed using recommended and havent had a virus or tracking cookie since. >

It's one thing to share one's personal experience, but it's illogical to extend that experience into a general rule of thumb for all users to follow. Other variables may have been in play.

 

[NoN]

Well, in ten years i've been trap once...
I'll not worry that much, just a little more surfing carefully and where the cheese go.

 

[Brink]

Update:

Microsoft Security Advisory (2757760): Vulnerability in Internet Explorer Could Allow Remote Code Execution

 

[kpo6969]

Thanks Brink for the Fix-It link.

 

[pincushion]

I only use IE9 for 'trusted' sites like this forum and news, other major sites etc. so I rely on their operators to be aware of such malware and to close the site down if a problem occurs. As mentioned, most anti-malware will catch this stuff anyway. I use Firefox to surf any other sites and always have a system image back-up (Macrium) to fall back on in the event of malware - never needed to though. I will be updating the OS when a proper solution is provided.

:huh:

 

[Anak]

Thoughts on those Fix-its...

• If a user enables the Fix-it does s/he have to disable it before applying the next round of patch Tuesday updates or will the IE update override the Fix-it? This is presuming there is an update for IE, and it is a harden version of the Fix-it.

• Or is the Disable Fix-it only there if the Enable Fix-it causes problems with the users machine?

• Some Fix-its do not have a Disable feature, why?

• Does anyone know of a link that explains the functionality of Fix-its? I know about the Microsoft Fix it Solution Center: troubleshooting software issues, and I have searched the MS Library, but I can not find any basic KB article on how Fix-its function, and whether or not they affect regular updates.

 

[Hopalong X]

Update:

Microsoft Security Advisory (2757760): Vulnerability in Internet Explorer Could Allow Remote Code Execution

Thanks Shawn. I added both IE64 and 32 to EMET per the link.

It wasn't too hard to figure out.

If someone needs help with adding to EMET I have SNIPS as I did it.
Post questions at the EMET tutorial Brink linked to in Post #14 below.


If you have a problem with IE after adding to EMET it can be removed from EMET with one click of the mouse.

 

[Brink]

http://www.sevenforums.com/tutorials/133386-enhanced-mitigation-experience-toolkit-emet.html