MS03-032 / 822925 patch doesn't work
Son of a patch, it happened again.
I reported in the Sept. 4 issue of Brian’s Buzz that a patch for Internet Explorer 5 and 6 that was rated “critical” by Microsoft should be installed immediately: bulletin MS03-032 and Knowledge Base article 822925.
After that newsletter was released, Microsoft acknowledged that the patch does not successfully close one of the serious flaws that it was intended to correct. eEye Digital Security’s chief hacking officer Marc Maiffret was quoted in a News.com article as saying that the remaining flaw is “so easy to exploit” that it could soon wreak havoc.
The software giant on Sept. 8 added text to its MS03-032 bulletin saying, “Microsoft is investigating these reports and will re-issue this bulletin with an updated patch that corrects these problems.” The Redmond company is also trying to clean up the fact that installing MS03-032 breaks ASP.NET applications running locally on Windows XP machines, as I described in the Sept. 4 issue. Microsoft gave no estimate of the date when a corrected patch might become available.
The security hole that still exists after the installation of the MS03-032 patch is critical because a PC can be taken over by a hacker if the PC user merely views a malicious e-mail or Web page. As eEye describes it in an alert, even IE users running Windows Server 2003 may be vulnerable. IE on Server 2003 cannot by default view ActiveX content, which is a feature of many Web pages. But many users “may have chosen to reactivate the ability to view active content,” eEye says.
Until Microsoft has an updated patch available, you can disable ActiveX content in IE to guard against hackers taking over your PCs. One way to do this in IE involves clicking Tools, Internet Options, Security, then selecting the Internet Zone, clicking the Custom Level button, and disabling ActiveX.
To send me more information about this, or to send me a tip on any other subject, visit WindowsSecrets.com/contact.
Top-scoring articles in the past 12 months
- Leaving long cookie trails throughout the Web 5.00
- Windows-like security for Android devices 5.00
- Win7′s no-reformat, nondestructive reinstall 4.56
- LizaMoon infection: a blow-by-blow account 4.46
- RPV: Win7′s least-known data-protection system 4.35
- Recovery: the last step in total data security 4.31
- The sorry tale of the (un)Secure Sockets Layer 4.30
- Time for a .NET update we can’t ignore 4.30
- Getting the most from Windows Search — Part 1 4.25
- Revising printing habits saves money and trees 4.25
- Upgrades end in erratic, partial hangs 4.25
- Get wired performance from your Wi-Fi network 4.24
- Caution: Bumps in the road to IPv6 4.23
- Patch Watch adds problem-patch update chart 4.23
- ZeuS Trojan reinvents itself as bots rock on 4.22
- Pros and cons of a ‘keyfile’ password 4.21
- April brings showers of browser patches 4.20
- Readers comment on the LizaMoon infection story 4.20
- Office 2007 gets its final service pack 4.19
- The advanced system-recover toolkit 4.18
- Putting Registry-/system-cleanup apps to the test 4.18
- One year and 99 security bulletins later 4.18
- Don’t pay for software you don’t need — Part 3 4.17
- What to do when Windows refuses to boot 4.17
- Make the most of Windows 7′s Libraries 4.16
- Keeping you up to date: say no to .NET — again 4.16
- Internet Explorer gets another round of patches 4.15
- Vacation’s over; it’s a big round of patches 4.15
- Big-time Wi-Fi security for the small office 4.14
- Office File Validation patch leads to problems 4.14
