Friday, January 30, 2009
On MondayIE8 RC1 was released. Here are some of the most interesting improvements and bug fixes to the XSS Filter feature: Some byte sequences enabled the filter to be bypassed, depending on system locale URLs containing certain byte sequences bypassed the Beta 2 filter implementation in some locales. For example, with a Chinese locale system, URLs of the following format would bypass the filter:
Thursday, January 29, 2009
Handle: C-Lizzle IRL: Celene Temkin Rank: Program Manager 2 & BlueHat Project Manager Likes: Culinary warfare, BlueHat hackers and responsible disclosure Dislikes: Acts of hubris, MySpace, orange mocha Frappaccinos! Goodbye 2008- Hello 2009! Over the past year we, the MSRC EcoStrat team and all-up TwC Security have been a lot of places, seen a lot of people, and picked up a lot of t-shirts J.
Wednesday, January 28, 2009
Periodically we get reports into the MSRC of stack exhaustion in client-side applications such as Internet Explorer, Word, etc. These are valid stability bugs that, fortunately, do not lead to an exploitable condition by itself (no potential for elevation of privilege). We wanted to clarify the distinction between stack exhaustion and stack buffer overflow.
Sunday, January 25, 2009
小野寺です。 最近、ワームの関するものが多くなっていましたが、ワームへの感染もふくめて、事件・事故に合
Friday, January 23, 2009
小野寺です。 日本国内よりは、海外が主ですが、Conficker (Downadup)について、Micr
Thursday, January 22, 2009
Hi, Bill here, In response to continued customer questions on how to protect and defend themselves against the Conficker Worm, I wanted to let you know the Microsoft Malware Protection Center has published a Threat Research and Response Blog that centralizes Microsoft’s guidance. This will help you understand the nature of the threat and enable you to formulate a defense in depth strategy based on the aspects of your unique environments.
Thursday, January 22, 2009
** Handle:** Security Blanki IRL: Sarah Blankinship Rank: Senior Security Strategist Lead Likes: Vuln wrangling, teams of rivals, global climate change - the hotter the better Dislikes: Slack jawed gawkers (girls are geeks too!), customers @ risk, egos As we head into this new year, predictions abound in the security ecosystem for 2009.
Thursday, January 15, 2009
Register now for the January 2009 Security Bulletin Webcast Security Bulletin Webcast Q&A Index Hosts: Christopher Budd, Security Response Communications Lead Adrian Stone, Lead Security Program Manager (MSRC) Website: TechNet/security Chat Topic: January 2009Security Bulletin Date: Wednesday, January 14, 2009 Q: So just to clarify there is no known code in the wild and if there was to be how would it get injected into the environment?
Thursday, January 15, 2009
Hi, During this month’s webcast we were able to address 21 questions in the time allotted. We addressed several questions regarding MS09-001 and its relationship to previously released SMB bulletins. There were also questions regarding update deployment and attack vectors addressed. The remaining questions primarily concerned the Malicious Software Removal Tool (MSRT) update regarding the W32/Conficker worm.
