Microsoft plans to patch IE zero day -- eventually

Attackers are probably trying to develop exploit code, the CTO of Qualys says

Microsoft said Thursday it plans eventually to patch a vulnerability in Internet Explorer 8 that it's known about for seven months, but it didn't say when.

A security research group within Hewlett-Packard called the Zero Day Initiative (ZDI) released details of the flaw on Wednesday after giving Microsoft months to address it. The group withholds details of vulnerabilities to prevent tipping off hackers but eventually publicizes its findings even if a flaw isn't fixed.

Microsoft said it had not detected attacks that used the vulnerability, which is a "use-after-free" flaw, which involves the handling of CMarkup objects.

The company did not give a reason for the long delay but said in a statement that some patches take longer to engineer and that "we must test every one against a huge number of programs, applications and different configurations."

"We continue working to address this issue and will release a security update when ready in order to help protect customers," it said.

To exploit the flaw, an attacker would have to convince a user to visit a malicious website. If the attack were successful, a hacker would have the same rights as the victim on the computer and could run arbitrary code.

Microsoft's next patch release, known as "Patch Tuesday," is scheduled for June 10. It occasionally issues an emergency patch if a vulnerability is being widely used in attacks.

Wolfgang Kandek, CTO of Qualys, wrote that exploit developers are probably studying ZDI's advisory to try to develop an attack.

"We do not know how quickly an exploit will be released, but the remaining time to Patch Tuesday is not that long," he wrote.

The Belgian researcher who found the flaw, Peter Van Eeckhoutte, wrote on his blog on Thursday that although Microsoft has known of the bug for a long time, "I don't believe this is an indication that Microsoft is ignoring bug reports or doesn't care about security at all, so let's not exaggerate things."

"In fact, Microsoft is doing an excellent job in handling vulnerability reports, issuing patches and crediting researchers," he wrote. "But I would be really worried if the bug was actively being exploited and left unpatched for another 180 days."

---

Best Microsoft MCTS Certification, Microsoft MCP Training at certkingdom.com

Microsoft office is not use by most of employees anymore

Study finds the merely Office applications are still in used daily is Outlook, which is terrible news for Microsoft.

So Microsoft won't be pleased to see this new survey from SoftWatch. In a 3 month research involving 148,500 employees at 51 global companies, SoftWatch discover that 7 in 10 employees were barely using Office, and those who did just used it to sight documents or for very light editing. The report is available as a PDF.

Windows and Office: Microsoft has 2 cash cows. They assist offset losers like Bing and Windows Phone and give the huge profits that the non-sexy groups, like tools and server applications, don't provide.

On standard, employees spent about 48 minutes per day using Microsoft Office. About two thirds of that time was spent on Microsoft Outlook, checking and responding to email. Excel was next, with just eight minutes of usage per day.

The study divided users into important users, light users, viewers, and inactive users. A full 30% of employees never used Excel or Word or used it only to view documents sent to them.

PowerPoint, the leader of presentations, has been knocked down to minimal use. The research found only about one in 19 users could be described as heavy users.

Now, it needs to be noted that SoftWatch sells analytics products specially geared toward serving a corporation determine whether moving some staff from more costly licenses like Microsoft Office to cheaper applications like Google would help reduce expenses. SoftWatch is also a Google Applications reseller.

So they have a point when they say transitioning light Office users to Google Applications can save a company up to 80% to 90% on their Microsoft licensing cost, but they also have a dog in that fight.

And of course, Microsoft has made its own shift with Office, transitioning many clients to the on-demand version, Office 365. Since Microsoft changed how it breaks out its income, we can't determine whether Office sales are down from last year.

Obviously my observation is skewed, but one thing SoftWatch didn't give details is where all those Office users go. If they have indeed abandoned Word and Excel and Powerpoint, what are they using in its place? That is something every body would like to know.

---

Best Microsoft MCTS Certification, Microsoft MCP Training at certkingdom.com