Unofficial patch posted by Researcher Vista News Discuss Unofficial patch posted by Researcher in the Windows Vista forums; Researcher posts unofficial patch for Windows URI bug Posted by Arneh on Tuesday, Oct 16, 2007, 6:05 pm - A researcher beat Microsoft Corp. to the patch punch yesterday by ...

[Snuffy]

Researcher posts unofficial patch for Windows URI bug
Posted by Arneh on Tuesday, Oct 16, 2007, 6:05 pm -

A researcher beat Microsoft Corp. to the patch punch yesterday by publishing an unofficial fix for a critical flaw in Windows XP and Server 2003 on PCs with Internet Explorer 7.

KJK::Hyperion, a.k.a. "Hackbunny," a researcher believed to live in Italy, posted a link to the 16KB patch on both his Web site and the Full Disclosure security mailing list Sunday. KJK's patch, dubbed "ShellExecuteFiasco," blocks the execution of malformed URLs and forces normalization of valid URLs. URL normalization, which can include tasks such as changing a URL to all-lowercase and stripping out the "www" part of the address, is a technique used by search engines to reduce indexing of duplicate pages.

Users who apply the patch do so at their own risk, KJK warned. "The present patch is dramatically under-tested and it has underwent [sic] no quality assurance procedure whatsoever, so please deploy with the greatest care," he said in the notes accompanying the fix. "It has a very good chance of misbehaving and making your system unusable."


http://www.computerworld.com/action/...ntsrc=hm_topic