Re: Informational Alert - Microsoft Security Bulletin MS06-042 Updated on 15 August 2006

Mike Blasingame wrote:
> Fellow Admins,
>
>
>
> I am passing along this additional alert from Microsoft about the most
> recent security bulletins and patches they issued.

[snip]

> This alert is to notify you that Microsoft has updated the caveats
> section of security bulletin MS06-042
> <http://www.microsoft.com/technet/security/Bulletin/MS06-042.mspx> on 15
> August 2006.
>
>
>
> For some Internet Explorer 6.0 Service Pack 1 users, Internet Explorer
> may exit unexpectedly while attempting to access Web Sites using both
> the HTTP 1.1 protocol and compression. A hotfix and workaround for this
> issue is available, please see Knowledge Base Article 923762
> <http://support.microsoft.com/kb/923762/> for more information. A new
> version of KB918899 <http://support.microsoft.com/kb/918899> is
> currently in development and will be released to all Internet Explorer 6
> Service Pack 1 customers on the Download Center and Windows Update by
> *August 22nd, 2006*.

[snip]

If I am reading this correctly, one could conceivably work around this
issue in the following ways:

1. apply the above hotfix

2. don't use IE for BFS stuff (use Firefox? Netscape? Opera?)

3. don't apply the patch for MS06-042 (or back it out), but DO apply the
patch for the infamous MS06-040.

As John Weber pointed out, we're already seeing exploits in the wild.
More importantly, there's a big botnet forming that uses MS06-040 as its
attach vector. If we can work around this issue while still
*aggressively* patching for MS06-040, that would be ideal.

To paraphrase Andy Dufresne, get busy patching, or get busy cleaning up
lots of compromised hosts.

michael

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.
Received on Tue Aug 15 16:54:29 2006