Tag: Microsoft

  • These two weeks of Word flaws – can we survive?

    [This was originally published on the OSVDB blog.] Courtesy of Juha-Matti Laurio at the Securiteam Blogs: http://blogs.securiteam.com/?p=764 Since 5th December we have seen three separate, serious vulnerabilities in Microsoft Word: [Disclosed – original reference – CVE nameAffected products and product versions] Tue 5th Dec – MS Security Advisory #929433 – CVE-2006-5994 and FAQWord 2003/2002/2000, Word…

  • McAfee: Microsoft patches 133 Critical/Important Vulns in 2006

    [This was originally published on the OSVDB blog.] http://www.avertlabs.com/research/blog/?p=153 McAfee is reporting that Microsoft patched 133 Critical / Important vulnerabilities in 2006. They also compare this number against previous years to presumably demonstrate that security isn’t getting better at Microsoft.

  • Under Pressure…

    [This was originally published on the OSVDB blog.] Microsoft is finding themselves under increasing pressure to release fixes for critical vulnerabilities. This week, Microsoft broke from tradition again and opted to release and early fix for a critical Internet Explorer vulnerability. Since we’ve seen other critical vulnerabilities come up before this one, some of which…

  • Browser Fun

    [This was originally published on the OSVDB blog.] http://browserfun.blogspot.com/ This blog will serve as a dumping ground for browser-based security research and vulnerability disclosure. To kick off this blog, we are announcing the Month of Browser Bugs (MoBB), where we will publish a new browser hack, every day, for the entire month of July. The…

  • Microsoft Silently Patches…

    [This was originally published on the OSVDB blog.] Sure, the news that Microsoft silently patches vulnerabilities made the rounds. But honestly, who was surprised in the least? We’ve all known it is a common practice among many vendors, not just Microsoft. As you may have guessed, the reasoning behind this practice is a commonly heard…

  • Microsoft Opens IE Bug Database

    [This was originally published on the OSVDB blog.] Microsoft Opens IE Bug Database Microsoft has established a public database to allow Internet Explorer users to report bugs in the Web browser. To post or view bugs, users must sign up for a Passport account on the Microsoft Connect Web site. Microsoft plans to allow non-registered…

  • The Excel Pebble

    [This was originally published on the OSVDB blog.] Back on December 8th, 2005, I posted a comment about someone who created an eBay entry for a “Brand new Microsoft Excel Vulnerability”. The vulnerability was never sold via eBay, but may have traded hands through other means. For the most part, this incident faded into the…

  • A Time to Patch

    [This was originally published on the OSVDB blog.] http://blogs.washingtonpost.com/securityfix/2006/01/a_timeline_of_m.html Brian Krebs has a fantastic post on his blog covering the time it takes for Microsoft to release a patch, and if they are getting any better at it. Here are a few relevant paragraphs from it, but I encourage you to read the entire article.…

  • Vendor Protection Rackets

    [This was originally published on the OSVDB blog.] I had planned on writing about this weeks ago but got swamped with that pesky day job along with the steady stream of new vulnerabilities released daily. That steady stream that absolutely will not get better with vendors taking a new approach to dealing with them. Fortunately…

  • A Day in the Life of a Security Bulletin

    [This was originally published on the OSVDB blog.] A Day in the Life of a Security Bulletinhttp://blogs.technet.com/msrc/archive/2005/09/28/411635.aspx Hi all- Alexandra Huft here again! I thought you might find it interesting to see “behind the scenes” of how a security vulnerability eventually becomes a security bulletin. So, I’ll start way back at the beginning. We receive…