When was the last critical IE update?

Here's a weird, possibly overly paranoid question:

When was the last MS critical patch update put out?

When I go to the windows update page, and have it search for critical updates, it has given me (0) as the number of patches. It's been like this for a couple of weeks. When I view the installation history, it shows security patch KB828749 from November 27th as the last installed patch. Am I being too negative toward MS to assume there has to have been a critical patch since then?

If so, does anyone know why my Iexplore (vs. 6 SP1, using Win2k SP4) would not detect the new updates?

Thanks.

Here's a full list of the Critical Updates. 824145 was the last for IE. 828749 was a security patch.


http://www.microsoft.com/windows/ie/...al/default.asp
http://www.microsoft.com/technet/tre...n/MS03-049.asp

MS has been struggling to keep their updates on a regular schedule, along the lines of releasing on Tuesday of the first or second week of the month, etc., unless it qualifies as a critical patch. This is being done to simplify patch management for corporate customers.

If you're being paranoid, then so am I because I've become accustomed to the weekly security updates and am suspicious that I haven't seen any for a few weeks either...

FWIW, there has been a flaw discovered in IE that MS has even publically acknowledged (the ability to spoof the URL address in the address bar, a risk to people using e-com or other secure sites). However, they won't classify it as a critical threat and a patch has yet to be released. In response, there has actually been an open-source patch released that is not MS-endorsed or recommended.

I've seen details on the flaw, but I can't comment on how easy it would be for a site to exploit because I'm really not sure. I'm going to have to hope that MS has done their homework and feels that we're safe by withholding a patch until the next round of updates, because a cynic might argue that MS is down-playing the flaw and gambling that no-one will be affected in a headline-gaining way before the scheduled patch...

Anyways, just remember that being paranoid doesn't mean that people aren't actually out to get you...! :D

Cheers,
KV

Just a reminder that tomorrow is the second Tuesday of this month.

OK, thanks for that.

I'll keep an eye out tomorrow.

This thread has reminded me that I have not been receiving the MS Security Patch notices recently. I used to get them when they were about individual patches, but since MS switched to the monthly notice, I have not got them.
So I thought I would resubscribe
http://www.microsoft.com/security/se...ins/alerts.asp
We'll see what happens, though I probably have just missed the January notice.
It is also possible to view the list of updates from these sites
Critical (IE and Windows)
http://www.microsoft.com/windows/ie/...al/default.asp
Security
http://www.microsoft.com/technet/tre...ty/current.asp

OMG....How long has that email alert site been up..

for gods sake please dont post that...were gonna get even more people with that ms email virus saying they have the email update and applied it and now there fried....

Quote:

---

Originally posted by Welshjim
I probably have just missed the January notice.

---

DuaneB was on the money, it just came out today, and there's even a warning about ignoring emailed security patches from Microsoft. Still no patches for IE, though:

-----BEGIN PGP SIGNED MESSAGE-----

- --------------------------------------------------------------------
Title: Microsoft Windows Security Bulletin Summary for
January 2004
Issued: January 13, 2004
Version Number: 1.0
Bulletin:
http://www.microsoft.com/technet/sec...n/winjan04.asp

- --------------------------------------------------------------------

Summary:
========
Included in this advisory is an update for a newly discovered
vulnerability in Microsoft Data Access Components (MDAC).
This vulnerability is rated Important.

MS04-003 - Buffer Overrun in MDAC Function Could Allow Code
Execution (832483)

- Affected Software:
- Microsoft Data Access Components 2.5 (included with
Microsoft Windows 2000)
- Microsoft Data Access Components 2.6 (included with
Microsoft SQL Server 2000)
- Microsoft Data Access Components 2.7 (included with
Microsoft Windows XP)
- Microsoft Data Access Components 2.8 (included with
Microsoft Windows Server 2003)

- Impact: Remote Code Execution
- Version Number: 1.0


Update Availability:
===================
An update is available to fix this vulnerability.
For additional information, including Technical Details,
Workarounds, answers to Frequently Asked Questions, and Update
Deployment Information please read the Microsoft Windows Security
Bulletin Summary for January at:
http://www.microsoft.com/technet/sec...n/winjan04.asp

Support:
========
Technical support is available from Microsoft Product Support
Services at 1-866-PC SAFETY (1-866-727-2338). There is no
charge for support calls associated with security patches.
International customers can get support from their local Microsoft
subsidiaries. Phone numbers for international support can be found
at:
http://support.microsoft.com/common/international.aspx

Additional Resources:
=====================
* Microsoft has created a free monthly e-mail newsletter containing
valuable information to help you protect your network. This
newsletter provides practical security tips, topical security
guidance, useful resources and links, pointers to helpful
community resources, and a forum for you to provide feedback
and ask security-related questions.
You can sign up for the newsletter at:

http://www.microsoft.com/technet/security/secnews

* Join our Microsoft webcast for a live discussion of the technical
details of the January security bulletins and steps you can take
to protect your environment. Details can be found at:

http://msevents.microsoft.com/CUI/EventDetail.aspx?
EventID=1032241586&Culture=en-US

* Protect your PC: Microsoft has provided information on how you
can help protect your PC at the following locations:

http://www.microsoft.com/security/protect/

If you receive an e-mail that claims to be distributing a
Microsoft security patch, it is a hoax that may be distributing a
virus. Microsoft does not distribute security patches via e-mail.
You can learn more about Microsoft's software distribution
policies here:

http://www.microsoft.com/technet/sec...icy/swdist.asp


Revisions:
==========
* V1.0 January 13, 2004: Bulletin Created.
********************************************************************
Protect your PC: Microsoft has provided information on how you
can help protect your PC at the following locations:
http://www.microsoft.com/security/protect/

If you receive an e-mail that claims to be distributing a
Microsoft security patch, it is a hoax that may be distributing a
virus. Microsoft does not distribute security patches via e-mail.
You can learn more about Microsoft's software distribution
policies here:
http://www.microsoft.com/technet/sec...icy/swdist.asp
********************************************************************
- --------------------------------------------------------------------
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT
DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING
THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE
LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY
FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING
LIMITATION MAY NOT APPLY.
- --------------------------------------------------------------------


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQEVAwUBQARTW40ZSRQxA/UrAQG0***Aikd8TsoZAf5ia7vopDERJDKRmB9c9ZHU
3ki1iHvO3zTqi6MP4pWElD3hEMhnxafNhEsn/ZHK68YABLMYREJM7g++H5AvcGYj
rI1CgbQJaKLgsbOaCyBXJ12vLjSJffHC23IcvICSXTd+PGGrGEQEDjAtd66mGsHW
g/9Eib0rnhi0Nc2bY/Y3frz3K2y6hKfS8adH9stJeK9WtQ7m7S0fcjrXKWrllyHB
WTefc3yp7KgC7582Df8QMaOuvN/PXi0YXgYa0hgvXd7KE7MOzMMxoyJgtMNdIXyw
3aUqHtiuJPFjk+EOKzaUTAowpP16VAh+iMbk5hRlQEnP0xz8s1JzNA==
=/d8h
-----END PGP SIGNATURE-----


*******************************************************************

You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service. For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp

If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below:
Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.

The patch for IE was delayed.

http://www.internetnews.com/dev-news...le.php/3298251

Makes me feel better about sticking with Mozilla Firebird as my primary browser... ;)

KV

Quote:

---

Originally posted by kv
Makes me feel better about sticking with Mozilla Firebird as my primary browser... ;)

KV

---

Im right there with ya kv :D

How's the security with the Mozilla browser? Any holes? How's the encryption? I've grown weary of IE over the years and have been contemplating changing browsers. Are there any issues when installing other browsers on XP or is it safe to install and test drive without worrying about a screwy system?


Thanks,

Cj

I had it on xp when i ran xp on my system and it worked fine :)

Quote:

---

Originally posted by SeaJay
How's the security with the Mozilla browser? Any holes? How's the encryption? I've grown weary of IE over the years and have been contemplating changing browsers. Are there any issues when installing other browsers on XP or is it safe to install and test drive without worrying about a screwy system?


Thanks,

Cj

---

The good thing about Firebird is that it runs on top of the OS, rather than being integrated into it like IE. That gives it an extra degree of security and makes it less likely to de-stabilize your system. If you do run into problems, it is simple to un-install. Like TangZ said, there were no problems or conflicts running it with XP.

The encryption is standards-compliant, meaning you can use it securely with banking sites, ecom etc., just as you would IE.

I was using IE for years, started using Firebird a while back after reading a few threads on this board and haven't regretted it.

As to security holes etc., I can't absolutely guarantee there aren't any but I've yet to see any, and you've got two advantages: a) as I mentioned above, it isn't integrated into the OS and b) the hackers are focused on MS and aren't spending too much time finding exploits in third-party browsers.

Personally, I'm fairly impressed with it and like to give props where deserved, so I have no hesitation recommending it.

Just MHO...!

KV

kv:

Thanks for the informative post. I think I'll give it a try. The fact that it isn't weaved into every nook and cranny of the OS is reason enough. The only negative comment I found on the internet was one about some minor javascript problems, but that's no problem. If I hit a page and absolutely need the javascript to run (but it doesn't), I'll use IE.

Thanks again for the information!

Cj