0day reported in Internet Explorer 6 and 7

Of course you use Firefox (or Chrome or Opera), so this shouldn’t concern you too much. But if you use the older versions of Internet Explorer, you should get with the system and start using a different browser.

Symantec reports that they’ve confirmed a 0day attack vector for IE 6 and IE 7, which was posted earlier on BugTraq.

The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future… The exploit targets a vulnerability in the way Internet Explorer uses cascading style sheet (CSS) information… the attack requires JavaScript to exploit Internet Explorer.

The moral of the story? Get Firefox.

UPDATE: Microsoft has acknowledged the security hole in Security Advisory 977981. The bottom line: get Firefox.

Firefox 3.5.5 and Google Chrome 3.0.195.32 now available

As Microsoft releases KB976749 for Internet Explorer (the patch for the MS09-054/KB974455 security patch), Mozilla has released Firefox 3.5.5 which fixes stability problems with version 3.5.4 (a list of bugs fixed in 3.5.5 mentioned here). Meanwhile, Google has released version 3.0.195.32 of the Google Chrome browser, which contains several security fixes noted on this Google Chrome releases blog page.

Download Firefox 3.5.5 here.
Download Google Chrome 3.0.195.32 from here.

Even when using either Firefox or Chrome instead of Internet Explorer, it would be best to patch either one or even all browsers installed on your computer.

Microsoft Security Essentials is doing well

You all know by now that I’ve thrown away AVG Free and replaced it with Microsoft Security Essentials, on all of my many machines, right?

I wrote about MSE in my Windows Secrets Newsletter column. (Yes, that’s in the paid version, but you can subscribe and pay any amount you choose.)

A small antivirus analyzing group called AV-Comparatives.org has just published a white paper that looks at how well antivirus products handle viruses that are common, in the wild, right now.

MSE scored in the top category “Advanced +” right up there with Symantec, F-Secure and Kaspersky, and ahead of ESET, Sophos, AVG, McAfee, AVAST and Avira.

MSE’s a great product. Free. Fast.

Firefox 3.6 Beta 1 now available from the Mozilla web site

After many days of delays, Mozilla has finally released Beta 1 of the next generation of the Firefox web browser. Firefox 3.6 beta 1 can be found here.

You can learn more about the Firefox 3.6b1 browser on this Mozilla Developer news page.

A reminder that this is BETA software and NOT the final product. Do not download and install this beta on a computer that has critical data files on there.

Firefox versions 3.5.4 & 3.0.15 and Seamonkey 2.0 Browser Suite now available

Mozilla has recently released Firefox versions 3.5.4 and 3.0.15 on their web site. Start updating to either version and get the latest security fixes for Firefox 3.0 and 3.5.

And for those using the Seamonkey browser suite, get the final release of Seamonkey 2.0 here. This major release now uses the same gecko engine code as the latest release of Firefox 3.5.

Enjoy using either one or even both of those browsers on your computer.

We’re still at MS-DEFCON 2

I still strongly recommend that you do NOT apply the October Black Tuesday patches.

Susan Bradley’s Patch Watch column in this week’s Windows Secrets Newsletter describes known problems with MS09-054, MS09-056, MS09-058, MS09-061, and MS09-062.

Oy.

MS-DEFCON 2: Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don’t do it.

Should you install 64-bit Windows 7?

Several of you have written, wondering about whether it’s time to make the jump to 64-bit Windows 7. It’s a good question, and there’s no easy answer.

I give the issues a thorough airing in my Windows Secrets Newsletter Top Story for July 16. Check it out.

Firefox versions 3.5.3 and 3.0.14 now available

Mozilla has just released versions 3.5.3 and 3.0.14 of their Firefox web browsers.

Start updating to either of these latest security releases when you get the chance.