Security Group Issues Emergency IE Patch

[engine]

Following on from New Internet Explorer Vulnerability Posted on Web [webmasterworld.com]

A group of security professionals has created a third-party fix for a recently discovered Internet Explorer flaw that's increasingly being used in cyber attacks.

The group, which calls itself the Zeroday Emergency Response Team, or Zert, created the patch so IE users can protect themselves while Microsoft works on an official fix.

Security Group Issues Emergency IE Patch [software.silicon.com]

Would you install a third party patch? I'm not sure I would.

[jbinbpt]

No. It scares me enough to install the "Offical" patches.

[BillyS]

I'll wait for an official patch. It might be costly later on in terms of conflicts.

[rj87uk]

Whats more shocking is the fact that a patch comes from a 3rd party faster than Microsoft. pffft.

[Angelis]

Which version of IE is it for?

[Angelis]

Nevermind

"IE versions 5.01 and 6 on all current versions of Windows are affected."

[Demaestro]

This is what happens with scheduled updates.

Microsoft has patch Tuesday.

Unscrupulous coders have exploit Wednesday knowing how long they have until the patch comes out.

I guess it is nice that someone is being preemtive about this. However I do have some reservations about installing a third party patch.

I try to only use my IE to test my own sites so I don't need to patch it right away as I trust my sites.

[Hugene]

This is an amazing ironic jab at MS, doing their job for them.

[bill]

The MS patch is now ready for download.

• [update.microsoft.com ]
• [windowsupdate.microsoft.com ]

[Tidal2]

Unscrupulous coders have exploit Wednesday knowing how long they have until the patch comes out.

Disagree for two reasons:

1. An optimal time would be sometime before patch Tuesday giving MS insufficient time to test and release on Tuesday

2. MS can always issue a special if its serious enough.

Just a question if anyone knows, did IE7 Beta have the same problem? A success for MS if not so.

Edit: added 'not' to last line above.

[edited by: Tidal2 at 7:54 pm (utc) on Sep. 27, 2006]

[aspdaddy]

Unscrupulous coders have exploit Wednesday knowing how long they have until the patch comes out.

It only becomes a real threat when the patch is released and admins delay installing it. There are an infinate number of *theoretical expoloits* awaiting patches. Zero day exploits are a problem though, but still best to wait for the vendor.

>Zeroday Emergency Response Team
I wouldnt install antyhing from anyone calling themselves that :)