Just a quick post about a story that we covered in this weeks show. The story that we covered was in relation to the vulnerability in the way in which windows handles .ani files. This from Microsoft’s site issued on the 31st of March:

“Microsoft is investigating new public reports of attacks exploiting a vulnerability in the way Microsoft Windows handles animated cursor (.ani) files. In order for this attack to be carried out, a user must either visit a Web site that contains a Web page that is used to exploit the vulnerability or view a specially crafted e-mail message or email attachment sent to them by an attacker.”

Microsoft have known about this vulnerability since December 2006. The plan was to patch this vulnerability on April 10th, but due to the increasing number of attacks and the risk to users they plan to patch this on Tuesday.

Knightwise would call this slack patching, or patching a problem only when it becomes a public issue or could cause a serious loss of face for Microsoft. I too do not believe that we should have waited three and a half months for this to have happened. However, I use Firefox and I am therefore somewhat protected but I would be cautious in saying I was immune. I do after all have a Windows system. Still another argument to use an alternative other then IE.

Source: Cnet News

This entry was posted on Wednesday, April 4th, 2007 at 1:21 am and is filed under General. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.