6 responses to “Another out-of-band Internet Explorer patch”

1. 

   Merdiwen July 28th, 2009 at 05:15

   Does this hole affect me on windows XP even if I never use IE?

2. 

   Yuhong Bao July 28th, 2009 at 06:04

   “Why is this being distributed as an out-of-band patch? Microsoft says there are no currently known exploits.”
   Because this ATL security hole is the source of the recent MS Video ActiveX control security hole. And so the exploit for the recent MS Video ActiveX control security hole basically is an exploit for the ATL security hole. Get it now?

   Also, I’d generally recommend that your readers read the advisory and update any old ActiveX controls killed by the kill-bit patch to prevent them from being broken.

3. 

   Yuhong Bao July 29th, 2009 at 00:54

   “Because this ATL security hole is the source of the recent MS Video ActiveX control security hole. And so the exploit for the recent MS Video ActiveX control security hole basically is an exploit for the ATL security hole. Get it now?”
   Actually that isn’t exactly true, see this article:
   http://blogs.msdn.com/sdl/archive/2009/07/28/atl-ms09-035-and-the-sdl.aspx

4. 

   rc primak July 30th, 2009 at 05:01

   If you read the SANS Report on this vulnerability, it turns out that the ATL flaw is much deeper. One News Report at Infoworld.com attributes the whole mess to an Active X Control which had a typo involving one extra “&” in the code. This means that a wide range of Microsoft and non-Microsoft software may be affected. Microsoft is still assessing the extent of the vulnerabilities. It is not limited to IE, nor even to Windows and other Microsoft products.

   I expect to see a lot of patches from quite a few vendors in the next few weeks to patch this flaw. Anyway, that’s my impression as an IT non-professional.

5. 

   EP July 31st, 2009 at 22:11

   Users should also patch Adobe Flash Player for IE and Firefox as mentioned on this Adobe security advisory:
   http://www.adobe.com/support/security/advisories/apsa09-04.html

   This Adobe security bulletin also mentions installing the MS09-034 patch for Internet Explorer. So patching IE is only half the battle won. Patching Adobe Flash Player completes the other half.

6. 

   woody August 1st, 2009 at 06:40

   Quite true – and the Flash update should be offered the next time you use Flash.

   As always, I recommend people use a third-party scanner and update tool like Secunia PSI.