----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                   National Cyber Alert System

                 Cyber Security Alert SA08-352A


Microsoft Internet Explorer Data Binding Vulnerability

  Original release date: December 17, 2008
  Last revised: --
  Source: US-CERT


Systems Affected

    * Microsoft Internet Explorer
    * Microsoft Outlook Express
    * Other software that uses Internet Explorer components to render documents


Overview

  A vulnerability in Internet Explorer could allow an attacker to
  take control of your computer.


Solution

  Apply an update

  The updates to address these vulnerabilities are available on the
  Microsoft Update site. We recommend enabling Automatic Updates.

  Disable Active Scripting  This vulnerability can be mitigated by
  disabling Active Scripting in the Internet Zone, as specified in
  the Securing Your Web Browser document. Note that this will not
  block the vulnerability, but it will help to protect your computer
  against a common method used to execute this vulnerability.
  Enable DEP in Internet Explorer 7  Enabling DEP in Internet
  Explorer 7 on Windows Vista can help mitigate this vulnerability by
  making it more difficult to achieve code execution using this
  vulnerability.


Description

  When rendering certain documents, Internet Explorer may crash or
  allow an attacker to run code on your computer. The attacker could
  install malicious software or access sensitive personal
  information. Attackers are actively exploiting this vulnerability.

  For more technical information, see US-CERT Technical Alert
  TA08-352A and US-CERT Vulnerability Note VU#493881.


References

 * US-CERT Technical Cyber Security Alert TA08-352A -
  <http://www.us-cert.gov/cas/techalerts/TA08-352A.html>

 * Microsoft Security Bulletin MS08-078 -
  <https://www.microsoft.com/technet/security/bulletin/ms08-078.mspx>

 * US-CERT Vulnerability Note VU#493881 -
  <http://www.kb.cert.org/vuls/id/493881>

 * Securing Your Web Browser -
  <https://www.us-cert.gov/reading_room/securing_browser/#Internet_Explorer>

 ______________________________

One of Yahoo Inc.'s largest shareholders, Ivory Investment Management LP, is urging the Internet company to pursue a sale of its search unit to Microsoft.

In a letter to the company's board, the investment firm proposed a deal Wednesday in which Microsoft (nasdaq: MSFT - news - people ) would acquire Yahoo (nasdaq: YHOO - news - people )'s search engine and Yahoo would retain 80 percent of revenue generated by search queries on its own site.

Ivory said Yahoo could get about $15 billion from Microsoft for the search platform alone, a deal it said would give shareholders a value of $24 to $29 per share, or more than double Yahoo stock's closing share price Tuesday of $12.19.

Yahoo shares rose 62 cents, 5.1 percent, to $12.81 in morning trading Wednesday.

Yahoo Chief Executive Jerry Yang said recently that he would resign, a response to shareholder discontent that brewed after Yahoo rebuffed a $47.5 billion takeover offer from Microsoft for the entire company. Before stepping down, Yang said he was still open to some kind of a deal with Microsoft, after antitrust concerns sank Yahoo's planned advertising partnership with Google Inc. (nasdaq: GOOG - news - people )

Microsoft CEO Steve Ballmer has said a takeover of Yahoo is off the table but has expressed interest in the company's search business.

In the letter Wednesday, Ivory took Yahoo's board to task for not seeking a deal with Microsoft more aggressively and accused the company of ignoring shareholder interests. The firm holds 21.4 million, or about 1.5 percent, of Yahoo's shares.

Microsoft said Tuesday it has opened a new research center in Switzerland to develop internet telephony software, also known as Voice-over-IP.

The U.S. tech giant said the center, located in Zurich, will grow from 45 to 200 staff over the next three years.

Microsoft Corp. (nasdaq: MSFT - news - people ) said in a press release that the site complements three other centers developing communications software in Beijing, China; Hyderabad, India; and Redmond, Washington.

A percentage of Google traffic is stripped of identifying information. Why?

Google likes to portray itself as a company that does everything in the open. But it appears that at least some of its employees are harboring a secret.

Web researcher Net Applications recently discovered that between 11% to 30% of traffic streaming out of Google's (nasdaq: GOOG - news - people ) Mountain View, Calif., office is stripped clean of the usual identifying information that accompanies such traffic. That begs the question: What secret is it that Google doesn't want the rest of the Web to know?

The finding, first reported in InternetNews.com, quickly sparked online chatter about a Windows challenger in the works. "I'd be shocked if Google wasn't developing its own operating system," says Vince Vizzacarro, Net Applications' executive vice president of marketing. "They clearly want to ride online services without using Microsoft."

The Aliso Viejo, Calif.-based firm made the discovery after adding a new feature to its analytics software that pinpoints the source of Internet traffic down to a specific company. The technology, which tracks various trends in Internet usage by analyzing traffic to more than 40,000 Web sites around the world, can also detect a computer's browser, IP address, referring search engine or search term, default language and screen resolution.

The new data showed that a percentage of Internet users in Google's offices (principally based in the company's Mountain View headquarters) are using an operating system that essentially shields itself from detection by stripping traffic of identifying information. Vizzacarro describes this data, known as a user agent, as a string of information that a computer uses to identify itself. Removing it (possibly via a proxy server) means that outsiders like Net Applications can't tell which operating system a particular Web user is using. (Net Applications uses other methods, like a Web site's JavaScript to detect other information about a user and determine that the traffic is coming from Google.) About 11% of Google's Web traffic currently shows up like this. The level fluctuates daily, Vizzacarro says. A few days ago it was around 30%.

Traffic from Microsoft employees, in contrast, can be parsed in detail, leading some to wonder why Google is taking pains to cover its tracks. "It's not a natural process.

Google is the only company we've seen that does this," Vizzacarro says. Google employees not using the secret OS are employing various versions of Unix, such as Linux or Ubuntu, and some older operating systems, like X11, he says.

Microsoft says it's bringing in a former Yahoo search executive to lead its online push.

Microsoft Corp. (nasdaq: MSFT - news - people ) says Qi (pronounced 'CHEE') Lu will be president of its Online Services Group. He'll be responsible for search and online advertising, where Microsoft lags far behind the leader, Google Inc. (nasdaq: GOOG - news - people )

Lu worked for Yahoo Inc. (nasdaq: YHOO - news - people ) for a decade, and led an overhaul of its online search and ad platform that helped boost ad revenue. He left Yahoo when the company proposed using Google's advertising engine instead of its own.

Lu is filling a slot left vacant in July. One of the top internal contenders for the job, Brian McAndrews, will leave Microsoft. McAndrews was chief of aQuantive (nasdaq: AQNT - news - people ), an online ad company Microsoft bought in 2007.

Copyright 2008 Associated Press. All rights reserved. This material may not be published broadcast, rewritten, or redistributed

Yang is heading out, the stock is crazy cheap and the company is profitable. What gives, Carl?

A federal judge has ordered Microsoft Corp. CEO Steve Ballmer to testify in a class-action lawsuit challenging the company's marketing of its Windows Vista operating system.

U.S. District Judge Marsha Pechman ruled earlier this year that consumers could pursue a class action suit against Microsoft for labeling some PCs as "Vista Capable," even though many were not powerful enough to run all of Vista's features.

Microsoft had opposed the motion to depose Ballmer. But Pechman wrote Friday that plaintiffs had shown that Ballmer may have had unique knowledge of the "Vista Capable" program.

Ballmer must give a deposition in the next 30 days.

A Microsoft spokesman says the company will comply with the order.

Microsoft to Google: Get Off of My Cloud

 

Corporate America is increasingly leaving computing to the experts. Why go to the trouble and expense of building and managing complex systems to handle your spiraling data-crunching needs when another company can do it for you? And who better, faster, or cheaper than Google (GOOG)?

That's just the kind of conventional wisdom Debra Chrapaty wants to change. As Microsoft's (MSFT) vice-president for Global Foundation Services, Chrapaty wants to prove that her company is no less capable of running the sprawling data centers to offer software doled out via the Internet. The company is especially keen to handle the ubiquitous Microsoft software that consumers and corporations have been running for themselves for the past few decades. "Google has done a great job of hyping" its prowess, Chrapaty says. "But we're neck and neck with them."

And if Microsoft isn't there yet, it may be soon. Chrapaty, who's in charge of Microsoft's data centers, is stepping up a multibillion-dollar building binge, BusinessWeek has learned. Her group is embarking on a plan to build in the coming years some 20 supersize data centers that can cost as much as $1 billion apiece, according to a person familiar with Microsoft's plans. "We're going to reinvent the infrastructure of our industry," Chrapaty says. She declines to discuss specifics of the plan.

Google's Got a Head Start

The moves are designed to support what Microsoft describes as the biggest strategic shift since it first targeted the Internet in the mid-1990s. The company has unveiled a range of offerings in recent weeks that embrace what's come to be known as "cloud computing." There's Azure, a new operating system that lets companies run software either on their own computers or as a service delivered via the Internet by Microsoft. There's a new Windows Live offering that lets consumers store, retrieve, and share photos, blogs, and other Web content with friends. And Microsoft has announced an Internet version of its Exchange corporate e-mail, and plans to do the same with its Office software. If Chrapaty's group can't handle the load, many customers may decide to forgo Microsoft's products in favor of rival cloud computing services.

Traditionally, Google has positioned itself as the leader. "We've been designing infrastructure for the cloud for years," says Matt Glotzbach, a manager who works on Google Apps for corporations. "We've got a pretty big head start vs. a company like Microsoft."

Tapping into Cheap Energy

Still, Microsoft can hold its own, says Gartner (IT) analyst David Cappuccio. "Microsoft may certainly be just as good" in areas such as energy efficiency, Cappuccio says. And amid the global economic malaise, cash-rich Microsoft and Google are alone in being able to "throw several billion dollars into something like this," says Matt Rosoff, an analyst at Directions on Microsoft.

Microsoft's bold data center strategy dates back at least five years. Before that, the company relied heavily on other hosting companies to do the work. Soon after the arrival of Chrapaty, a former chief technology officer for the NBA, Microsoft decided to bring the job in-house. When in 2005 Ray Ozzie persuaded Microsoft founder Bill Gates and CEO Steve Ballmer to make the move to online delivery of software in 2005, running data centers became even more important. Chrapaty began bringing in industry luminaries from companies including Hewlett-Packard (HPQ) and Intel (INTC).

Street's Rally Can't Lift Citigroup

This is a transcript of the Market Update: Close video report.

Apple's new OS X could force Microsoft to dump its beleaguered operating system.