Slashdot Mirror

How much faster does the keyboard layout makes you, then?

Like, how do you score on this test?

Lame articles, good trolling, CmdrTaco Writing "the Two Towers" as "the Who Towers"... ACs are still totally fucking gay in case you were wondering.

Typing game if you're bored

DETAILS

When the overflow is triggered, a fixed sized buffer in stack gets overwritten with data from the gopher server

You have got to be terminally thick in the head to write code that does that. I always hear these stories about the IQ-testing Microsoft entrance exams... did they outsource IE production to some schoolboys or something?

I note that clicking the gopher link listed at http://www.solutions.fi/index.cgi/news_2002_06_04 redirects me to http://www.infospace.com/info.gopher/ in IE but Mozilla 0.9.9 ignores the click on the link completely. Going to http://www.solutions.fi/iebug2/run.cgi gives me a broken QuickTime graphic in IE, but the text document in Mozilla. What's going on? Is this a bug or isn't it?

I note that clicking the gopher link listed at http://www.solutions.fi/index.cgi/news_2002_06_04 redirects me to http://www.infospace.com/info.gopher/ in IE but Mozilla 0.9.9 ignores the click on the link completely. Going to http://www.solutions.fi/iebug2/run.cgi gives me a broken QuickTime graphic in IE, but the text document in Mozilla. What's going on? Is this a bug or isn't it?

Youll notice in the article that you dont actually have to have a gopher server running. MSIE just has to connect to the trap via a gopher-like URL.

Why the h3ll is anyone motivated to find bugs in IE's gopher protocols?!? It must have been a real slow day at Oy Online Solutions for them to find this.

Where are you getting that? The related article says, 'According to Oy Online, a hacker could take over a user's computer simply by having the user click on a link to a "hostile Gopher site." That one click would install and run any program the hacker chose on the victim's computer, and the victim might never know'

According to the oy online page "The part of code in IE which parses gopher replies contains an exploitable buffer overflow bug... . The server can be very minimal, ie. a program that can listen on a TCP port and write a block of data; a fully operational gopher server isn't necessary in order to carry out the attack. "

It looks like an accurate link to a gopher server is needed for this attack.

It looks like there needs to be a hostile site existing, unless you have another link.

Exactly.. it wouldn't take long for a page that says Download the UT 2003 demo to nuke a bunch of computers. (Where's the demo anyway, dammit, I'm dying to play!)

As I pointed out yesterday, there's more info about the bug and it's prevention available from Oy Solutions, who found the exploit.

Well, sort of, anyway. They don't go into much detail because of fear of people exploiting it, but it's some kind of buffer overflow (big surprise there) triggered by a malicious Gopher server.

You can go here http://www.solutions.fi/iebug2/run.cgi to test your system to see if it's vulnerable.

Odd though, when I hit it in IE, it asks me if I want to download the program or not.... maybe this isn't as serious as originally thought.

Of course in Mozilla it just shows the code in the browser :-)

This site contains technical info on the hole. It's a buffer overflow.

Luckily Microsoft has their own internal group to generate bad press... the development group. Check out the article about the new IE gopher exploit. It was found by Oy, and they have more info.

The short answer: You can try to sue Microsoft, but they have more lawyers than you do, and you actually have to make a case before a judge.

The particular "exploit" that this thread is about is that IE asks you what you want to do with the file you are downloading before asking the web server to download it. Once the request is made to download the file, the web browser uses the information stored within the headers to name and dispatch the file.

So, one could put up a file on a site, link to it as readme.txt. The readme.txt file, upon download (i.e. in the HTTP headers sent by the server) would actually be readme.exe, with an appropriate MIME type. IE then saves readme.exe and attempts to execute it (if you told it to open the "readme.txt" file. According to the source in the linked article, available here, this exploit works differently on different browsers, however, if you never open a file directly, but rather, choose "Save As..." you will never have a problem. The Save As dialogue will tell you what the file should really be named, and you can cancel it at this point without continuing to download it if it was not the type you expected.

So, no, you can't sue Microsoft because someone exploits someone else using Microsoft's product. And if you did sue, your odds of winning would be less than odds of winning the lottery. This isn't a security hole. Whenever you open any file type on the internet, you implicitly trust the person serving it to you to not make it harmful. My recommendation is to buy an anti-virus and stop wasting people's time asking if you can sue about it. Or, perhaps hit Save As instead of Open if you don't trust the site.

If you engineer idiot-proof software, lo and behold, the world will engineer better idiots. -Mike

"Microsoft will patch a flaw in its Web browser that could allow an attacker to silently download and execute malicious programs on the computers of users who view a specially constructed Web page or e-mail message." (emphasis added)

From the article's intro:

"Microsoft has known about it since November 19; they refuse to provide any information about when a patch might be made available, if ever."

Also: "And keep in mind that Microsoft is in no hurry to do anything about it . . ."

Full marks for a more thorough description of the exploit and how it came about -- but did the poster actually read the article before posting? Looks to me like he hit the original report but not the article, which says that MS did initially plan to let it go, but did an about-face after a while.

Nasty flaw nonetheless -- glad I switched to Mozilla.

I've evaluated software packages for my company for 7 years, and I have found absolutely nothing distatefull/upsetting about anything that has come through our pipe through IE. Sure you have a few porn URL's finding their way into the logs once in awhile (usually the newer employees testing the limits of our IT usage policy) but nothing that can be considered malicious.

We take the usual precautions with our servers (standard antivirus, NT service packs) and as far as I'm concerned, that should be enough for anybody. I for one am tired of worried employees clogging up my (Outlook) in-box asking me if their work is at risk because of these "security holes". I try not to be smug when I reply that most of these claims are fraudulent and only meant to discredit a legitimate company with scare-tactics, flowery (and overcomplicated) techie-garble and lies.

Please, for the sake of making my job easier, stop posting imaginary stories about imaginary Microsoft security holes.

Check this story about finding a serious cookie vulnerability in Microsoft Internet Explorer and MS policy dealing with it.

Because it takes them a staggering five days to "reproduce the behaviour" - even when working exploit code is provided for them.