A critical new vulnerability lingers in Internet Explorer, just as Microsoft tries to task users with helping build its malware database.
Details
Is it possible that Microsoft intends to get a leg up on Symantec and other competitors by co-opting users into serving as a free sampling network? The software giant, perhaps misjudging the mood of many IT security managers and other users sophisticated enough to identify and isolate a virus, has published e-mail addresses for users to submit samples of viruses, worms, and other malware.
You can send your viruses to avsubmit@submit.microsoft.com; submit your spyware samples to windefend@submit.microsoft.com. Microsoft would apparently like users to submit samples in a particular way, but I'll leave that for you to discover if you want to participate as an unpaid security consultant.
Of course, some of us feel that Microsoft might be better off fixing existing security issues in applications. A good place to start is Internet Explorer 6, which turned out to contain yet another critical new vulnerability.
Exploit code is already available to take advantage of the latest big hole in IE 6. The vulnerability, which exists even in fully patched IE 6 and Windows XP SP2 versions, can allow remote attackers to gain complete control over a vulnerable system. On March 24, Microsoft reported that it had received reports of attacks using this vector.
Microsoft has addressed the HTML Object flaw, which can corrupt memory, in Microsoft Security Advisory 917077 ("Vulnerability in the way HTML Objects Handle Unexpected Method Calls Could Allow Remote Code Execution"). It seems that the only users not at risk for this are those who are actually using the Microsoft Internet Explorer 7 Beta 2 Preview, released on March 20.
There are currently two Microsoft-approved workarounds for this vulnerability. However, both methods can adversely impact functionality.
- Set IE to prompt before running Active Scripting, or simply disable Active Scripting in the Local Intranet Security Zone.
- Set Internet and Local Intranet Security Zones to High (which causes IE to prompt before running Active Scripting).
Also this week, Secunia has reported that Sendmail versions prior to 8.13.5 harbor a critical vulnerability. The official designation for this new remote access threat is CVE-2006-0058. Sendmail.org recommends that users either apply the patch for version 8.13.5 and version 8.12.11, or upgrade to version 8.13.6.
Final word
As the tax deadline looms, I wanted to point out some useful tax tips that don't get much publicity. First, every year media organizations make a gigantic deal out of the rush to file before midnight on tax deadline day.
It's obvious why the IRS likes this publicity, and we all know that TV news is all about scaring people so they concentrate on unimportant things, but any tax professional knows that you don't have to file by this year's April 17 deadline. Just pay a good faith estimate of what you think you owe (if anything), and file a 4868 automatic extension form by April 17. Every year, millions of people drive themselves to a frantic state of exhaustion, skipping deductions they're entitled to, when all they need to do is sign and submit a simple one-page form.
Second, if you have an adjusted gross income less than $50,000, you can get free tax software from the IRS. And no, the IRS really won't cheat you.
Third, if you have somehow "forgotten" to file for the past few years, and you don't actually owe anything, you haven't broken the law. I've gotten into several fights over the years about this one, but it's true: Most people aren't really required to file a tax return—just to pay their taxes.
The consequences of this misconception are serious. If you didn't file but are due a refund because of excessive withholding, you only have until this year's April 17 deadline to file as far back as three years and get your refund.
Finally, I can't resist making one comment about Microsoft asking for users to help build its virus database—would that be like depending on unpaid beta testers to perform half of its development work?
Can't get enough of the IT Locksmith?
Don't miss John McCormick's TechRepublic blog! Bookmark it to get the security scoop on what didn't make the cut in this week's article.
Miss a column?
Check out the IT Locksmith Archive, and catch up on the most recent editions of John McCormick's column.
Want to stay on top of the latest security updates? Automatically sign up for our free IT Locksmith newsletter, delivered each Tuesday!
John McCormick is a security consultant and well-known author in the field of IT, with more than 17,000 published articles. He has written the IT Locksmith column for TechRepublic for more than four years.
