IE Download.Ject Exploit Fixed

Saint Aardvark writes "Just in time for the weekend, the Internet Storm Center is reporting that Microsoft is providing a fix for the Download.Ject vulnerability that hit IE late last month. The press statement says that it'll hit Windows Update later today..."

That reminds me...

[DaHat]

That assumes I remember to run Windows Update... Why do I have to do it myself Microsoft! I want automatic and forceful patch downloading and installation! Sure, you could throw in an extra DRM patch here or there... but I don't care, I'm lazy!

Get the fix early here.

[Saeed al-Sahaf]

The press statement says that it'll hit Windows Update later today...

O get the fix early, HERE. [mozilla.org]

Obvious link missing

[nizo]

Fix can be downloaded here [mozilla.org].

In Other News...

[Snagle]

The Department Of Homeland Security said it is safe to go back to using Internet Explorer as your main browser...for about 10 minutes, when the next exploit will be released.

The Vulnerability

[lousyd]

the Download.Ject vulnerability that hit IE late last month. The press statement says that it'll hit Windows Update later today..."

So, the vulnerability will hit Windows Update later today? How do they know? (Other than the fact that Microsoft is running security at the Windows Update site, of course.)

All right!!!

[k4_pacific]

That means all the sys-admins will have to work late on a Friday night making sure its installed.

Excellent timing.

I'm Not A Religious Person But...

[Anonymous Coward]

I'd recommend a little prayer before every time you click on a link in Internet Explorer.

I think my brain just exploded.

[Ira Sponsible]

This is completely incomprehensible. I'm using Mozilla Dangerphoenix, and ms let me get the download with no hassles at all. Of course it's not one of their usual updates, but I still find it hard to believe that they haven't broken the link for non-IE browsers like they do for the rest of their site. Unless the "Configuration Change" is really just an extension to "fix" my Mozilla Pornopony to behave just like IE. DAMN YOU MICROSOFT, WHEN CAN I TRUST YOU!!!

Re:Got it, but..

[drkhwk]

We won't even get into the fact that my online banking instantaneously loads on IE yet takes several /MINUTES/ to load in Firefox.

Then you should switch banks, not browsers.

Coming soon...

[sleighb0y]

Download.Ject.A
Download.Ject.B
Download.Ject.C
Download.Ject.D..............

Re:Um

[strictnein]

First post:
That assumes I remember to run Windows Update... Why do I have to do it myself Microsoft! I want automatic and forceful patch downloading and installation!

Second post:
I use Windows Update religiously and do not have the auto update feature running

Are you an idiot? Seriously.

Re:FYI

[Tackhead]

> This by-design functionality is sometimes used by web applications. However, when combined with known security vulnerabilities in Microsoft Internet Explorer, it could allow an internet web site to execute script from the Local Machine Zone (LMZ).

Ah, once again, "Security Zones" rears its ugly head. Wasn't integrating the browser into the operating system a brilliant move?

Ah, once again, the assumption that users are using Web-based apps in a trusted environment such as the office LAN, rather than the Real World(tm), rears its ugly head. Services listening on 135? 137? 139? 445? 5000? But how will you share files, printers? Doesn't everyone want to share every file with every other user on their network segment? Doesn't everyone want to automatically sniff out and configure their machine to work with every network-attached peripheral?

Open Letter to Windows design team, in monosyllables so you get the fucking point, because you sure as fuck haven't over the past nine years

Code. Code belong on hard drive. Code tell a C.P.U. to do stuff. You get code, you save code, you tell box to run code! O.S. do what code say, so if you get owned, is your fault cuz you tell O.S. to run code! This just fine!

Web Pages. Made of H.T.M.L. You get by click link. to make words and pics on screen. You got H.T.M.L.? I.E. for turn the H.T.M.L. into pics on screen. I.E. good for show text. I.E. good for show click link. I.E. good for show boobs.

Heap Big Clue: I.E. MADE OF CODE. I.E. CODE RUN ON LOCAL MACHINE. THEREFORE ALL ZONE ARE LOCAL. You no grok? Here two by four. Hit self in head until you grok, dumb ass.

This isn't chocolate and peanut butter. Executables and Web Content are not two great tastes that taste great together. Just because you can do something, doesn't mean you should.

Security "zones" are one of the dumbest fucking ideas ever to come down the pipe.

Obligatory Monty Python quote

[harley_frog]

I think this quote best reflect the state of denial that Microsoft is currently in:

Black Knight: Have at you.
King Arthur: You are indeed brave, sir knight, but the fight is mine.
Black Knight: Oh, had enough eh?
King Arthur: Look, you stupid bastard. You've got no arms left.
Black Knight: Yes I have.
King Arthur: Look.
Black Knight: Just a flesh wound.

I'm already patched!

[SnarfQuest]

Microsoft e-mailed me the patch some time ago, like they do with all their other security updates. I install them all as they come in, and keep my system virus free!

I Demand the Editors Change the Title...

[maggeth]

"Fixed" is a strong word, I suggest an alternate title for this article:

"Microsoft Kind of Does Something Vaguely Related to Download.Ject Exploit"

Dear Microsoft,

[stienman]

Dear Microsoft,
I am writing concerning downloading the most recent Windows Updates. I am unable to obtain them as your site requires IE, and the government recently suggested that users cease use of IE.

Please help!

-Adam

Re:If parent is true, please mod up!

[Sheepdot]

No offense taken.

I'm not exactly the most trustworthy person anyway, I've been compromising computers for the last 5 years.

IE Patches no worse than viruses?

[MooseByte]

"Second, I have never -- that means NOT EVER -- seen an IE fix that broke my machine worse than a virus would."

Hmmm. Well THERE's a ringing endorsement....

Re:FYI

[Anonymous Coward]

Guy make joke. You too serious. Here two by four. Hit self until grok.

Ian

Re:FYI

[Anonymous Coward]

Worry not. He no see boobs but from I.E..

Re:not a troll

[ssstraub]

Except IE isn't ready for prime time either, and it's at 6.0.