Microsoft Updates EMET Security Tool To Fix Update Flaw -- Redmondmag.com

Microsoft Updates EMET Security Tool To Fix Update Flaw

By Kurt Mackie
11/18/2010

Microsoft on Wednesday announced the new release of its Enhanced Mitigation Experience Toolkit (EMET) 2.0 solution to remedy a software interoperability problem.

EMET is designed to address general security vulnerabilities in software products without providing specific patches, which Microsoft describes as a "pseudo-mitigation" approach to enhancing software security. Version 2.0 of EMET was released in September, but Microsoft released an update on Wednesday to correct a flaw affecting Adobe and Google software.

EMET 2.0 has been causing problems for some users of Adobe Reader and Acrobat products, as well as the Google Chrome browser, according to a blog post by Andrew Roths and Fermin J. Serna, who serve on the engineering team at the Microsoft Security Research Center. Specifically, EMET is tripping up the update process for those software products.

The update problem is apparent with Adobe products if a reboot is required after a Reader or Acrobat update. For users of Google Chrome, the update problem occurs when one instance of the browser is set to be run as administrator. In such cases, other Chrome browsers will be blocked from updating, Microsoft's blog explains.

To address those problems, Microsoft released a new version of EMET, version 2.0.0.3, which is available at the Microsoft Download Center here. However, note that the version number displayed on that download page still reads "2.0."

Google noted on Tuesday that it had discovered the update problem associated with EMET and had notified Microsoft about it. Google's blog post dismissed the need to use EMET with the Chrome browser, saying that "because Chrome already uses many of the same techniques (and more), EMET does not provide any additional protection for Chrome." The blog recommends that users not use EMET with Google Chrome.

EMET is a tool developed by Microsoft researchers but it is not supported by Microsoft. The tool's main virtue is that it that attempts to block common security vulnerabilities in software that may not have a patch because the software is older and unsupported. It also can potentially help to protect line-of-business software that was built in-house long ago but yet continues to be used in an unmaintained form.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.
PowerShell Script Used in Phishing Attack May Be AI-Generated

A PowerShell script being used in a novel malware campaign may have been created by AI, according to security researchers at Proofpoint.
Using Microsoft Office to Build a Network Diagram, Part 1

Keeping documentation is a great way to ease your future hardware refresh and have what you need for insurance purposes.
Microsoft Claims Breakthrough in Quantum Computing Reliability

A new paper details Microsoft's recent progress in quantum computing -- specifically, its development of a system that is both significantly less prone to errors and better at correcting them.