Microsoft releases advisory for Web Proxy Auto-Discovery flaw

By

Microsoft today warned PC users of a Windows flaw that occurs when the operating system, or Internet Explorer, (IE) tries to find a Web Proxy Automatic Discovery (WAPD) server.

Microsoft releases advisory for Web Proxy Auto-Discovery flaw
The vulnerability exists in editions of Windows XP, Server 2003 and Vista, as well as IE versions 5, 6 and 7, when the operating system or browser resolves hostnames that do not include a fully qualified domain name.

Tim Rains, Microsoft security response communications lead, said today that his company has received no reports of public exploitation of the flaw.

Microsoft users who do not have a primary DNS (Domain Name system) suffix configured on their system, whose DNS domain name is registered as a second-level domain or who have specified a proxy server via DHCP (Dynamic Host Configuration Protocol) server settings are not affected by the flaw.

The vulnerability also does not affect customers who have a trusted WPAD server, who have manually specified a proxy server in IE, or who have disabled the “Automatically Detect Settings” option in IE.

Microsoft credited Beau Butler with reporting the flaw.

See original article on SC Magazine US
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:
computer securitymicrosoft securitysecurity

Sponsored Whitepapers

Powering secure AI at the Edge: What you need to know before it’s too late
Powering secure AI at the Edge: What you need to know before it’s too late
Ditch the Spreadsheets. Build a System That Grows With You.
Ditch the Spreadsheets. Build a System That Grows With You.
Gaining a Competitive Advantage with Communication APIs
Gaining a Competitive Advantage with Communication APIs
Leverage Technologies: Industry-Tailored ERP Implementation for Growth and Compliance
Leverage Technologies: Industry-Tailored ERP Implementation for Growth and Compliance
Service Over Signatures: The Truth About No Lock-In IT
Service Over Signatures: The Truth About No Lock-In IT

Events

Most Read Articles

Qantas obtains court order to prevent third-party access to stolen data

Qantas obtains court order to prevent third-party access to stolen data
Cloudflare makes changes to avoid repeat of 1.1.1.1 DNS outage

Cloudflare makes changes to avoid repeat of 1.1.1.1 DNS outage
CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments
ACSC alerts to exploited MS SharePoint remote code execution flaw

ACSC alerts to exploited MS SharePoint remote code execution flaw
techpartner.news logo
Dave Stevens on Brennan's evolution and the need for Aussie tech unity
Dave Stevens on Brennan's evolution and the need for Aussie tech unity
Sydney's ITKnocks on contact centre AI and the slow death of the IVR
Sydney's ITKnocks on contact centre AI and the slow death of the IVR
"It's an exciting time to be part of the health and aged care sector"
"It's an exciting time to be part of the health and aged care sector"
Insicon founder Matt Miller on the coming 'tsunami' of compliance and educating boards about cyber security
Insicon founder Matt Miller on the coming 'tsunami' of compliance and educating boards about cyber security
Orro claims Australia first with managed digital asset discovery service
Orro claims Australia first with managed digital asset discovery service

Log In

  |  Forgot your password?