The worrying thing is that the exploit (like most others) has been available
for hackers to exploit for the best part of a decade.
Which raises the question, how effective is patching, securitywise? Assuming
that (say) 50% of all NT/2000/XP exploits have now been found and patched,
that leaves 50% still available for hackers to exploit. If the hackers have
found some of the other 50% and the security guys haven't... then you have a
problem. No matter how well-patched you are.
Interestingly, the CCP (among other repressive governments) has teams of
hackers who are paid to do nothing other than find exploits in operating
systems that can be used to inject spyware into western systems containing
classified information. Thus it is very probable that a fair proportion of
that other 50% is known to someone, somewhere.
On that basis, patching is still a wise precaution, but it guarantees
NOTHING.
Just making that point, because it sometimes seems that too much faith is
placed in patching.
AliceZ wrote:
Last update: July 7, 2009 - 6:07 AM
SAN JOSE, Calif. - Microsoft Corp. has taken the rare step of warning about
a serious computer security vulnerability it hasn't fixed yet.
The vulnerability disclosed Monday affects Internet Explorer users whose
computers run the Windows XP or Windows Server 2003 operating software.
