CNET: "New Year, old flaws in Windows, Internet Explorer"

[Bush_Eats_Beef]

http://reviews.cnet.com/4520-3513_7-5621335-1.html?tag=cnetfd.sd

If you thought upgrading to Windows XP SP2 would end your Windows security nightmares, think again. Last Tuesday, Microsoft released three new security bulletins for 2005, including one critical patch for Windows XP SP2, last year's much-touted security upgrade of the Windows XP operating system. While Windows XP SP2 recompiled most of the basic system files to better protect you from malicious buffer overflows, the flaw in MS05-001 involves ActiveX, Microsoft's clever answer to Sun's Java technology. The two other vulnerabilities announced as part of the January monthly update release don't affect Windows XP SP2.

The other critical flaw patched by Microsoft last Tuesday also involves Internet Explorer--all versions. Should you surf to a page containing a maliciously formed cursor or icon, you may find yourself controlled by a remote cracker. MS05-002 is rated critical, in part, because there are already working exploits out on the Internet. Once an exploit is available, it is often only a matter of time before someone finds a way to create a virus or a worm from it. Trend Micro has an independent security assessment of this vulnerability.

Finally, the third patched flaw concerns the Windows indexing service, which is by default turned off on Windows XP and Windows Server 2003. Because of that, Microsoft has given MS05-003 its second-highest rating of "important."

Mozilla Firefox has been designed to run without ActiveX. But in all fairness, now that people are rushing to install Firefox, more and more flaws have been announced. Still, the flaws discovered in Firefox pale against those that exist in Internet Explorer. For one thing, given that there are exploits for at least one of these new vulnerabilities, we know that criminal hackers are interested in attacking IE. When there's a worm spreading exclusively via Firefox, I'll let you know.

SEE ALSO "Firefox flaw raises phishing fears," http://news.zdnet.com/2100-1009_22-5517149.html